{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:64bb6e2c-eda8-5e39-ac1b-d204be677b18",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina-jmx-remote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@9.0.13-tuxcare.4",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@9.0.13-tuxcare.4",
      "version": "9.0.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina-jmx-remote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@9.0.13",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@9.0.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:dc3b8132-6826-5b25-a2eb-e012672b1454",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat-catalina-jmx-remote. CVE-2016-8735 affects Apache Tomcat 9.x before 9.0.0.M12. The target is Tomcat 9.0.13, which already contains the upstream fix. The vulnerability involved unrestricted deserialization of JMX authentication credentials in JmxRemoteLifecycleListener. The fix restricts credential types to String[] and String classes only, preventing arbitrary object deserialization. Both components of the fix are present in the target: (1) credential type restriction at line 269, and (2) server.toStub() usage at line 325. The fix was authored by Mark Thomas (markt@apache.org) and shipped in upstream release 9.0.0.M12 (November 2, 2016), which predates the 9.0.13 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12; < 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12), Snyk (>= 6, < 6.0.48; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@9.0.13-tuxcare.4"
    }
  ]
}