{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:830dc06c-1a64-5ab6-b2a8-175499b71f99",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hadoop-client",
      "purl": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1",
      "type": "library",
      "group": "org.apache.hadoop",
      "bom-ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1",
      "version": "2.6.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "hadoop-client",
            "purl": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0",
            "type": "library",
            "group": "org.apache.hadoop",
            "version": "2.6.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2012-3376",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:49b17718-58c5-50a4-b3de-80a25a02552a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-3376 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-client. not_affected \u2014 Apache Hadoop 2.6.0 is not affected by CVE-2012-3376. The vulnerability, which allowed unauthorized block access when the same BlockPool was registered twice with inconsistent security settings, was fixed in upstream commits from 2012 and 2014. Both fixes (fbb1760459f and 4a943f194ca) are present in the target version, having been included in the upstream Apache Hadoop 2.6.0 release before TuxC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-4449",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f4bb8c27-656b-54c8-aee5-d7a4c532b701",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-4449 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-client. not_affected \u2014 The target repository (Apache Hadoop 2.6.0) is NOT affected by CVE-2012-4449. The vulnerability involved using a weak 20-bit secret for token password generation when Kerberos security features are enabled. The fix (changing KEY_LENGTH from 20 to 64) was committed by upstream Apache developer Owen O'Malley on Sep 24, 2012 (commit 38ec8babda5) and was already present in the upstream Hadoop 2.6.0...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3627",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dda9fec9-b314-54c7-a3ed-a843d8a73583",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3627 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-client. not_affected \u2014 CVE-2014-3627 affects Apache Hadoop 2.x before 2.5.2. The target is version 2.6.0, which already contains the upstream fix. The vulnerability allowed symlink attacks in tar archives to change permissions on arbitrary files to world-readable. The fix (commit e9f7079c) adds a symlink check in FSDownload.changePermissions() that returns early without following symlinks. This fix was authored by ka...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-3161",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5c33a64e-1b15-5600-9fd4-bd125ce3a132",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-3161 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-client."
      }
    },
    {
      "id": "CVE-2017-3162",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7664ddf-e41e-5043-ba85-7dacb6bf731d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2017-3162 is fixed in version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.hadoop/hadoop-client@2.6.0-tuxcare.1"
    }
  ]
}