{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ea84d9e0-44ce-5fb0-9e25-00a5288da848",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "plexus-utils",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1",
      "type": "library",
      "group": "org.codehaus.plexus",
      "bom-ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1",
      "version": "3.3.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "plexus-utils",
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0",
            "type": "library",
            "group": "org.codehaus.plexus",
            "version": "3.3.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-1000487",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8a8dcbe5-67a9-5876-81f0-8df9039db5e8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-1000487 does not affect version 3.3.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. The target plexus-utils version 3.3.0 is not affected by CVE-2017-1000487. The upstream fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41) that addresses the command injection vulnerability was already present in the upstream release 3.3.0 when TuxCare onboarded it. The fix eliminates shell interpretation for Unix/Linux systems by switching from getShellCommandline() to getCommandline()/getRawCommandline(), and improves quote escaping by using single quotes with proper embedded quote handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4244",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fa3bc000-1e1d-50d8-aeaf-b12826d06158",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-4244 does not affect version 3.3.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 is not present in plexus-utils 3.3.0. The upstream vendor (Christian Schulte) fixed this directory traversal vulnerability in commit 33a2853 (May 2016), which was included in the upstream 3.3.0 release. When TuxCare onboarded version 3.3.0 (commit 125c1d7), the fix was already present. The current HEAD (bb2be2c) contains an even stronger version of the fix from CVE-2025-67030 backport, which improved the original fix by using getCanonicalPath() instead of getAbsolutePath().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4245",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b382da93-f5b5-53a7-9011-6cfa43e9ff7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-4245 does not affect version 3.3.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 Target version 3.3.0 is not affected by CVE-2022-4245. The vulnerability fix (sanitization of XML comment delimiters `<!--` and `-->`) was already present in the upstream release 3.3.0 when TuxCare onboarded it. The fix was authored by Christian Schulte (upstream Apache developer) in commit f933e5e, which is an ancestor of the onboarding commit 125c1d7. The vulnerable code pattern does not exis...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-67030",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fbfdc8e7-cc60-5904-8dd3-7c482d57f9d4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-67030 is fixed in version 3.3.0-tuxcare.1 of org.codehaus.plexus:plexus-utils."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.0-tuxcare.1"
    }
  ]
}