{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:44e1fbbc-c580-58ac-a27e-43543f84629f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "groovy",
      "purl": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1",
      "type": "library",
      "group": "org.codehaus.groovy",
      "bom-ref": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1",
      "version": "1.6.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "groovy",
            "purl": "pkg:maven/org.codehaus.groovy/groovy@1.6.9",
            "type": "library",
            "group": "org.codehaus.groovy",
            "version": "1.6.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-3253",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3a344590-8fc8-5b5e-a907-ae868c516170",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-3253 is fixed in version 1.6.9-tuxcare.1 of org.codehaus.groovy:groovy."
      }
    },
    {
      "id": "CVE-2016-6814",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81e0cf39-0909-504c-b960-3b055603c8cc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6814 does not affect version 1.6.9-tuxcare.1 of org.codehaus.groovy:groovy. Groovy 1.6.9 is outside the affected range (1.7.0-2.4.7) of CVE-2016-6814. The known exploit chain needs a serialized ConvertedClosure (Proxy InvocationHandler) wrapping a MethodClosure; in 1.6.9 ConversionHandler/ConvertedClosure do not implement Serializable (Serializable was added in 1.7.0), so the chain cannot be built and the vulnerable MethodClosure deserialization is not reachable through it. Backporter attempts failed only on a broken 1.6.9 baseline build, not on the patch.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2020-17521",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7909dda2-6daf-5760-9c4e-e6729d791352",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17521 does not affect version 1.6.9-tuxcare.1 of org.codehaus.groovy:groovy. not_affected \u2014 Groovy version 1.6.9 is not affected by CVE-2020-17521. The vulnerable extension methods (File.createTempDir() in DefaultGroovyStaticMethods.java) that are the target of this CVE do not exist in this version. These methods were added later in Groovy 2.0+ via commit 949ca1553f (GROOVY-4879). The CVE explicitly states that \"Users not using the extension methods mentioned in the advisory are not a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-32303",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d2a3c420-0c8e-56bb-8bf9-74b529d4299e",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-32303 is a false positive for org.codehaus.groovy:groovy 1.6.9-tuxcare.1. false_positive \u2014 CVE-2023-32303 concerns the Planet Python package for satellite data API access, which stores authentication credentials in a secret file with overly permissive file permissions. This repository is Apache Groovy 1.6.9, a JVM programming language, not the Planet satellite software. This is a wrong-project match with no relationship between the two projects."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.groovy/groovy@1.6.9-tuxcare.1"
    }
  ]
}