{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a98da728-5fa1-5081-aecb-91e8b58c313b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "groovy",
      "purl": "pkg:maven/org.codehaus.groovy/groovy@2.5.7-tuxcare.1",
      "type": "library",
      "group": "org.codehaus.groovy",
      "bom-ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.7-tuxcare.1",
      "version": "2.5.7-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "groovy",
            "purl": "pkg:maven/org.codehaus.groovy/groovy@2.5.7",
            "type": "library",
            "group": "org.codehaus.groovy",
            "version": "2.5.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-3253",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd6d8199-076e-5235-9724-4452d3f979ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3253 does not affect version 2.5.7-tuxcare.1 of org.codehaus.groovy:groovy. CVE-2015-3253 affects Apache Groovy 1.7.0 through 2.4.3 via unrestricted deserialization of MethodClosure objects. The target repository (Groovy 2.5.7-tuxcare.1) is NOT AFFECTED because upstream Apache Groovy fixed this vulnerability before the 2.5.7 release. The fix consists of two deserialization protection mechanisms: (1) readResolve() method added in commit 09e9778e (July 2015) and (2) readObject() method added in commit 716d3e67 (October 2016). Both methods throw UnsupportedOperationException when deserialization is attempted, blocking the attack. These fixes were authored by upstream Apache contributors (cchampeau@apache.org and blackdrag@gmx.org) and were already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7.0, < 2.4.4; >= 1.7.0, < 2.4.4), NVD (= 1.7.0; = 1.7.0-beta_1; = 1.7.0-beta_2; = 1.7.0-rc1; = 1.7.0-rc2; = 1.7.1; = 1.7.2; = 1.7.3; = 1.7.4; = 1.7.5; = 1.7.6; = 1.7.7; = 1.7.8; = 1.7.9; = 1.7.10; = 1.7.11; = 1.8.0; = 1.8.0-beta_1; = 1.8.0-beta_2; = 1.8.0-beta_3; = 1.8.0-beta_4; = 1.8.0-rc1; = 1.8.0-rc2; = 1.8.0-rc3; = 1.8.0-rc4; = 1.8.1; = 1.8.2; = 1.8.3; = 1.8.4; = 1.8.5; = 1.8.6; = 1.8.7; = 1.8.8; = 1.8.9; = 1.9.0; = 1.9.0-beta_1; = 1.9.0-beta_3; = 1.9.0-beta_4; = 2.0.0; = 2.0.0-beta_1; = 2.0.0-beta_2; = 2.0.0-beta_3; = 2.0.0-rc1; = 2.0.0-rc2; = 2.0.0-rc3; = 2.0.0-rc4; = 2.0.1; = 2.0.2; = 2.0.3; = 2.0.4; = 2.0.5; = 2.0.6; = 2.0.7; = 2.0.8; = 2.1.0; = 2.1.0-beta_1; = 2.1.0-rc1; = 2.1.0-rc2; = 2.1.0-rc3; = 2.1.1; = 2.1.2; = 2.1.3; = 2.1.4; = 2.1.5; = 2.1.6; = 2.1.7; = 2.1.8; = 2.1.9; = 2.2.0; = 2.2.0-beta_1; = 2.2.0-beta_2; = 2.2.0-rc1; = 2.2.0-rc2; = 2.2.0-rc3; = 2.2.1; = 2.2.2; = 2.3.0; = 2.3.0-beta_1; = 2.3.0-beta_2; = 2.3.0-rc1; = 2.3.0-rc2; = 2.3.0-rc3; = 2.3.1; = 2.3.2; = 2.3.3; = 2.3.4; = 2.3.5; = 2.3.6; = 2.3.7; = 2.3.8; = 2.3.9; = 2.3.10; = 2.3.11; = 2.4.0; = 2.4.0-beta_1; = 2.4.0-beta_2; = 2.4.0-beta_3; = 2.4.0-beta_4; = 2.4.0-rc1; = 2.4.0-rc2; = 2.4.1; = 2.4.2; = 2.4.3), Snyk (>= 1.7.0, < 2.4.4; <= 0; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6814",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7e551303-e458-5df5-b063-dc73b132b74e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6814 does not affect version 2.5.7-tuxcare.1 of org.codehaus.groovy:groovy. Target Apache Groovy 2.5.7 is NOT affected by CVE-2016-6814. The vulnerability (unsafe MethodClosure deserialization allowing arbitrary code execution) was fixed in upstream commit 716d3e67e74 (Oct 2016) by adding a readObject() method that blocks deserialization by throwing UnsupportedOperationException. This fix was already present in the Apache Groovy 2.5.7 release before TuxCare onboarded it. The defense is present at src/main/java/org/codehaus/groovy/runtime/MethodClosure.java:74-79.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7.0, < 2.4.8; >= 1.7.0, < 2.4.8), NVD (>= 1.7.0, <= 2.4.3; >= 2.4.4, <= 2.4.7), Snyk (< 2.4.7; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17521",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4453a046-871d-5e6e-9c45-55b51eafa63b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-17521 affects version 2.5.7-tuxcare.1 of org.codehaus.groovy:groovy."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.7-tuxcare.1"
    }
  ]
}