{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:57e96a27-85f7-57c4-8a17-4d99513d3dd8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "commons-configuration2",
      "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1",
      "type": "library",
      "group": "org.apache.commons",
      "bom-ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1",
      "version": "2.1.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "commons-configuration2",
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1",
            "type": "library",
            "group": "org.apache.commons",
            "version": "2.1.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-1953",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7e380925-7898-56fe-81bb-c458664a4a37",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1953 does not affect version 2.1.1-tuxcare.1 of org.apache.commons:commons-configuration2. Version 2.1.1 is NOT AFFECTED by CVE-2020-1953. The vulnerability concerns unsafe YAML parsing in YAMLConfiguration class that allows arbitrary object instantiation via SnakeYAML type tags. However, version 2.1.1 predates the introduction of YAML support entirely - the YAMLConfiguration class, SnakeYAML library dependency, and all YAML parsing capabilities were added AFTER this version. The CVE lists affected versions as 2.2-2.6, and 2.1.1 is before this range. Comprehensive verification confirms no YAML processing code exists in the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-33980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b4860b90-ee8a-53f4-a9c0-03a2eb1bff07",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-33980 does not affect version 2.1.1-tuxcare.1 of org.apache.commons:commons-configuration2. Version 2.1.1 is not affected by CVE-2022-33980. The dangerous lookups (script, dns, url) that enable arbitrary code execution and remote server contact were introduced in version 2.4 when Apache Commons Configuration switched from Commons Lang3 to Commons Text and began auto-registering all Commons Text StringLookup instances. Version 2.1.1 uses only Commons Lang3 and has exactly three safe default lookups: sys (system properties), env (environment), and const (constants). The vulnerable code pattern never existed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-29131",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2108f5d9-34dc-5c76-b774-d452dda7fd93",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29131 is fixed in version 2.1.1-tuxcare.1 of org.apache.commons:commons-configuration2."
      }
    },
    {
      "id": "CVE-2024-29133",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5fe15cf6-2722-54c8-8f59-0dc1ce5fcab6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-29133 affects version 2.1.1-tuxcare.1 of org.apache.commons:commons-configuration2."
      }
    },
    {
      "id": "CVE-2026-45205",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6c707f8d-d224-5aa7-ada2-9e0cf077a3a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45205 does not affect version 2.1.1-tuxcare.1 of org.apache.commons:commons-configuration2. not_affected \u2014 Version 2.1.1 is NOT AFFECTED by CVE-2026-45205. YAML configuration support, which is the vulnerable component, does not exist in version 2.1.1. YAML support was introduced in version 2.2 (commit 09e2fe28 \"Support for JSON and YAML configurations\" in 2.2-SNAPSHOT). The CVE explicitly states the affected range is \"from 2.2 before 2.15.0\", and version 2.1.1 predates this range. Exhaustive searche...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.1.1-tuxcare.1"
    }
  ]
}