{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1bf64c27-4d63-5516-8b7d-83452ffa7c69",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-embed-programmatic",
      "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.50-tuxcare.16",
      "type": "library",
      "group": "org.apache.tomcat.experimental",
      "bom-ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.50-tuxcare.16",
      "version": "9.0.50-tuxcare.16",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-embed-programmatic",
            "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.50",
            "type": "library",
            "group": "org.apache.tomcat.experimental",
            "version": "9.0.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.50-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:2323adb7-a776-5eec-97ff-a89c871ba839",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat.experimental:tomcat-embed-programmatic. not_affected \u2014 The target Apache Tomcat 9.0.50-tuxcare.16 is not affected by CVE-2024-21733. The vulnerability affects versions 9.0.0-M11 through 9.0.43, and the fix was introduced in upstream version 9.0.44 (February 2021). Since the target is based on upstream 9.0.50 (released June 2021), the fix was already present in the upstream release when TuxCare adopted this version. Both required patches are present...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.50-tuxcare.16"
    }
  ]
}