{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b3cfca21-0c92-5ef1-aac4-51c35bb6b7ae",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3",
      "version": "8.5.78-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.78"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:49354580-62a6-5344-8c54-54c046c7a091",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 8.5.78 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass via the JspRuntimeLibrary.introspecthelper() method, which executed bean introspection with elevated privileges using AccessController.doPrivileged(). The fix was applied by Apache upstream in commit 648122fef8 (Aug 2, 2016) and was already present in version 8.5.78 when TuxCare onboarded it (commit fb98844404, Sep 20, 2026). The vulnerable code pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper) is not present in the target.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3"
    }
  ]
}