{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a4dfe42e-26fb-5b06-9787-3d3b2babdeb8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "grails-core",
      "purl": "pkg:maven/org.grails/grails-core@6.2.1-tuxcare.5",
      "type": "library",
      "group": "org.grails",
      "bom-ref": "pkg:maven/org.grails/grails-core@6.2.1-tuxcare.5",
      "version": "6.2.1-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "grails-core",
            "purl": "pkg:maven/org.grails/grails-core@6.2.1",
            "type": "library",
            "group": "org.grails",
            "version": "6.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1000529",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-core@6.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:9716f5be-6ff7-553b-953f-804e1fc5516e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1000529 does not affect version 6.2.1-tuxcare.5 of org.grails:grails-core. not_affected \u2014 CVE-2018-1000529 affects the Grails Fields plugin version 2.2.7 (XSS in display tag). This repository is grails-core 6.2.1, which has a declared dependency on Fields plugin version 5.1.0. The vulnerability was fixed in Fields plugin 2.2.8 by upstream commit 2b1e87c621 (May 2018, authored by lopezi@objectcomputing.com). This fix was already present in the upstream Grails 6.2.1 release before Tux...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-12728",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-core@6.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:c7ba5a3d-eed4-5b38-b791-b89d1a9382c1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-12728 does not affect version 6.2.1-tuxcare.5 of org.grails:grails-core. CVE-2019-12728 is NOT present in grails-core 6.2.1-tuxcare.4. The vulnerability concerned cleartext HTTP usage for SDKMan notification service resolution. Both upstream fix commits (a7be63abcc3 from Feb 2019 and 4a7c20a877 from May 2019) are present in HEAD and were part of the upstream Grails 6.2.1 release that TuxCare onboarded. The fixes were authored by graeme.rocher@gmail.com (upstream vendor). All repository URLs in build.gradle use HTTPS, and validation code (lines 630-638) actively prevents HTTP repository URLs. The vulnerable pattern (HTTP-based repository resolution) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.3.10), NVD (< 3.3.10), Snyk (< 3.3.10).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.grails/grails-core@6.2.1-tuxcare.5"
    }
  ]
}