{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a2b6b1e9-06a6-5b0d-9b6a-23b9dd1f1103",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hadoop-yarn-server",
      "purl": "pkg:maven/org.apache.hadoop/hadoop-yarn-server@2.6.0-tuxcare.1",
      "type": "library",
      "group": "org.apache.hadoop",
      "bom-ref": "pkg:maven/org.apache.hadoop/hadoop-yarn-server@2.6.0-tuxcare.1",
      "version": "2.6.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "hadoop-yarn-server",
            "purl": "pkg:maven/org.apache.hadoop/hadoop-yarn-server@2.6.0",
            "type": "library",
            "group": "org.apache.hadoop",
            "version": "2.6.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-25642",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hadoop/hadoop-yarn-server@2.6.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e7a38d65-8998-5c05-b51c-f6e8a3616186",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25642 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-yarn-server. Apache Hadoop 2.6.0 is not affected by CVE-2021-25642. The vulnerable component ZKConfigurationStore does not exist in this version. ZKConfigurationStore is a feature for dynamic capacity scheduler configuration via ZooKeeper that was introduced in later Hadoop versions (after 2.6.0). Version 2.6.0 uses only file-based configuration loading for the capacity scheduler, with no Java object deserialization from ZooKeeper. The vulnerable code path (ZKConfigurationStore.deserializeObject method that deserializes untrusted Java objects from ZooKeeper without class validation) is completely absent from the codebase.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.hadoop/hadoop-yarn-server@2.6.0-tuxcare.1"
    }
  ]
}