{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bfe6a14a-553b-5f17-9259-72b0fde37863",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-servlet-api",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@8.5.46-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@8.5.46-tuxcare.2",
      "version": "8.5.46-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-servlet-api",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@8.5.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2001-0590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@8.5.46-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:18edfcf0-5b19-5eeb-a545-0ce950fa3864",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2001-0590 does not affect version 8.5.46-tuxcare.2 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 CVE-2001-0590 affects Apache Tomcat versions prior to 3.2.2 (circa 2001), where malformed HTTP requests without protocol specification (HTTP/0.9 style) caused JSP files to be served as source code instead of being executed. The target is Tomcat 8.5.46 (released 2019), 18 years after the fix. The vulnerable code pattern is not present - modern Tomcat correctly routes all HTTP requests (including...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-2684",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@8.5.46-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:74e47950-7afa-5a76-ad01-0c16e21db12a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.2 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@8.5.46-tuxcare.2"
    }
  ]
}