{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:df841b60-fb07-5b0d-9718-2844cfc0fa7c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.13-tuxcare.4",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.13-tuxcare.4",
      "version": "9.0.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.13",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:db81bfd0-18ad-568f-8c17-ec0623adee41",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat-jasper. CVE-2016-5018 affects Apache Tomcat versions 9.0.0.M1-M9, 8.5.0-8.5.4, 8.0.0.RC1-8.0.36, 7.0.0-7.0.70, and 6.0.0-6.0.45. The vulnerability allowed malicious web applications to bypass a configured SecurityManager by calling JspRuntimeLibrary.introspecthelper(), which used AccessController.doPrivileged() to execute bean introspection with elevated privileges. The target (Tomcat 9.0.13) is NOT affected because the upstream fix (commit a6b1ebc246b91b854237e5aad3dfd2b5460ea282 by Mark Thomas, 2016-08-01) was already present in the upstream release 9.0.13 when TuxCare onboarded it. The vulnerable code pattern (PrivilegedIntrospectHelper class and privileged execution wrapper) is not present in the target. The introspecthelper method now runs with the caller's permissions, ensuring SecurityManager restrictions apply correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.13-tuxcare.4"
    }
  ]
}