{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6dc1c583-0fb5-505c-90c3-1284a4d75673",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "plexus-utils",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2",
      "type": "library",
      "group": "org.codehaus.plexus",
      "bom-ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2",
      "version": "3.0.17-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "plexus-utils",
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17",
            "type": "library",
            "group": "org.codehaus.plexus",
            "version": "3.0.17"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-1000487",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1b6b951a-8546-5c15-99ef-dd1a95dea5ea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-1000487 does not affect version 3.0.17-tuxcare.2 of org.codehaus.plexus:plexus-utils. The target repository (plexus-utils 3.0.17-tuxcare.2) is not affected by CVE-2017-1000487. The upstream fix from commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 authored by krosenvold@apache.org was already present in the upstream release 3.0.17 when TuxCare onboarded it. The CVE affects versions before 3.0.16, and version 3.0.17 contains all the necessary defensive code that prevents command injection through shell metacharacters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4244",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a22cf6fe-2bc8-5415-b189-0ef7c4e7814e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-4244 affects version 3.0.17-tuxcare.2 of org.codehaus.plexus:plexus-utils."
      }
    },
    {
      "id": "CVE-2022-4245",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:422fded1-d63c-5b93-8c9d-1bb01469c0af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-4245 is fixed in version 3.0.17-tuxcare.2 of org.codehaus.plexus:plexus-utils."
      }
    },
    {
      "id": "CVE-2025-67030",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f620e288-a565-5314-ac93-5122f97e14cc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-67030 is fixed in version 3.0.17-tuxcare.2 of org.codehaus.plexus:plexus-utils."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.17-tuxcare.2"
    }
  ]
}