{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f103ba78-f67c-5576-b8f8-ca6bc9ab7fbf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.2",
      "version": "9.0.39-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.39"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cae34f0e-98ce-5e72-88ed-e99441303335",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat-jasper. Target Apache Tomcat 9.0.39 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass through the PrivilegedIntrospectHelper class in JspRuntimeLibrary.java, which wrapped introspection operations with AccessController.doPrivileged(). The upstream fix (commit a6b1ebc246b91b854237e5aad3dfd2b5460ea282 by Mark Thomas, dated Aug 1, 2016) removed this privilege escalation mechanism and was already present in the upstream Tomcat 9.0.39 release when TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.2"
    }
  ]
}