{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:63050c04-f691-5b94-b4d7-f0ed6cfcf220",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bcprov-debug-jdk15on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1",
      "type": "library",
      "group": "org.bouncycastle",
      "bom-ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1",
      "version": "1.52-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "bcprov-debug-jdk15on",
            "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52",
            "type": "library",
            "group": "org.bouncycastle",
            "version": "1.52"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-6644",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c9f5c233-7c96-50e4-8b84-5d55bb133a06",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-6644 affects version 1.52-tuxcare.1 of org.bouncycastle:bcprov-debug-jdk15on."
      }
    },
    {
      "id": "CVE-2020-0187",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:566a6d99-7386-59c6-8392-6205050061f6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-0187 does not affect version 1.52-tuxcare.1 of org.bouncycastle:bcprov-debug-jdk15on. not_affected \u2014 CVE-2020-0187 is an incomplete mode-name comparison in BaseBlockCipher.engineSetMode. The mode name is upper-cased, then compared case-sensitively to a mixed-case literal, so \"PGPCFBwithIV\" selects the wrong PGP CFB variant. This target already uses equalsIgnoreCase for both PGP comparisons, and has done so since the oldest commit in its history, which is in the upstream release. The patch diff...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-33201",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e102946f-de1b-534d-8a56-64e9e285ce4b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-33201 affects version 1.52-tuxcare.1 of org.bouncycastle:bcprov-debug-jdk15on."
      }
    },
    {
      "id": "CVE-2025-14813",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dd46f93e-3a72-5d75-9d1a-986533822fd5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-14813 does not affect version 1.52-tuxcare.1 of org.bouncycastle:bcprov-debug-jdk15on. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes do not exist in this version. Version 1.52 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-574f-3g2m-x479 (affected up to 1.7.0), CVE record (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.52-tuxcare.1"
    }
  ]
}