{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ecf71b35-986f-5a6e-8af7-b0b13f487f60",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-servlet-api",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.46-tuxcare.13",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.46-tuxcare.13",
      "version": "9.0.46-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-servlet-api",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2001-0590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:c588bc64-29c8-5fe4-84b7-6828e53b512d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2001-0590 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 CVE-2001-0590 affects Apache Tomcat prior to version 3.2.2 (2001) and involves JSP source code disclosure via malformed HTTP requests lacking protocol specification. Tomcat 9.0.46 (2021) is not affected because the vulnerability was fixed in the upstream release approximately 20 years before this version was created. Modern Tomcat explicitly handles requests without HTTP protocol specification ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.46-tuxcare.13"
    }
  ]
}