{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6dacc155-aac8-5dc9-8ef4-2344d61e1ae4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "commons-compress",
      "purl": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1",
      "type": "library",
      "group": "org.apache.commons",
      "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1",
      "version": "1.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "commons-compress",
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.9",
            "type": "library",
            "group": "org.apache.commons",
            "version": "1.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-11771",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2887fcdb-21af-59cf-8ee1-1b45aefc200f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11771 is fixed in version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2018-1324",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:77ecb5e3-4018-5ee6-8a76-d5dcdf2a3dd9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1324 does not affect version 1.9-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.9 is NOT affected by CVE-2018-1324. The vulnerable class X0017_StrongEncryptionHeader does not exist in this version. The vulnerability was introduced in version 1.11 or later, and the CVE explicitly states the affected range is 1.11-1.15. TuxCare backported the fix to versions 1.12, 1.14, and 1.15 (the affected versions within their support scope) but did not ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-12402",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5182304d-562b-515a-af20-7214faf34bd7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-12402 affects version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a0e5fb55-d636-517a-a225-8d518ea4b3f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-35515 is fixed in version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35516",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ca3efadc-b6a5-5599-ba5b-f184b8f44649",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-35516 affects version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35517",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:39e49c1a-1e7a-5ccf-abfb-38325336fb16",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-35517 affects version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-36090",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:12f365e7-8dda-5c3c-8fa0-35dde0949bca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-36090 affects version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2023-42503",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a1530324-b543-5599-b115-5da62f482389",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42503 does not affect version 1.9-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.9 is not affected by CVE-2023-42503. The vulnerability was introduced in version 1.22 when support for high-precision PAX extended header time fields was added using BigDecimal parsing. Version 1.9 does not contain the vulnerable code pattern: it lacks the parseInstantFromDecimalSeconds() method, does not use BigDecimal anywhere in the codebase, and only proces...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-25710",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:22703524-323e-589e-86ca-ea18661bd621",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.9-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2024-26308",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5f0d096d-40e5-5a77-a97d-eef2840f7fff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-26308 does not affect version 1.9-tuxcare.1 of org.apache.commons:commons-compress. Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.9 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.commons/commons-compress@1.9-tuxcare.1"
    }
  ]
}