{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:223e629d-6174-5d3d-af06-4ab4fadbc30f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "qpid-jms-client",
      "purl": "pkg:maven/org.apache.qpid/qpid-jms-client@1.7.0-tuxcare.1",
      "type": "library",
      "group": "org.apache.qpid",
      "bom-ref": "pkg:maven/org.apache.qpid/qpid-jms-client@1.7.0-tuxcare.1",
      "version": "1.7.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "qpid-jms-client",
            "purl": "pkg:maven/org.apache.qpid/qpid-jms-client@1.7.0",
            "type": "library",
            "group": "org.apache.qpid",
            "version": "1.7.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-4974",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.qpid/qpid-jms-client@1.7.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:24609a0f-5cb2-5e50-8309-0d0c1218987d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-4974 does not affect version 1.7.0-tuxcare.1 of org.apache.qpid:qpid-jms-client. not_affected \u2014 CVE-2016-4974 describes unrestricted Java deserialization in Apache Qpid JMS client versions before 0.10.0. The vulnerability was the complete absence of any mechanism to restrict which classes could be deserialized from JMS ObjectMessages. Target version 1.7.0 contains the upstream fix (QPIDJMS-188, commit 669cfff8, June 2016) that introduced JmsDeserializationPolicy - a configurable allowlist...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.qpid/qpid-jms-client@1.7.0-tuxcare.1"
    }
  ]
}