{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6853f88a-a02e-53c9-bb7a-cdb4dde070e1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "grails-core",
      "purl": "pkg:maven/org.grails/grails-core@6.2.3-tuxcare.9",
      "type": "library",
      "group": "org.grails",
      "bom-ref": "pkg:maven/org.grails/grails-core@6.2.3-tuxcare.9",
      "version": "6.2.3-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "grails-core",
            "purl": "pkg:maven/org.grails/grails-core@6.2.3",
            "type": "library",
            "group": "org.grails",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1000529",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-core@6.2.3-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:01c8ab33-4777-5e92-999e-b8411adac0ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1000529 does not affect version 6.2.3-tuxcare.9 of org.grails:grails-core. not_affected \u2014 CVE-2018-1000529 affects the Grails Fields plugin version 2.2.7, not grails-core. This repository (grails-core 6.2.3-tuxcare.9) does not contain the fields plugin source code. The fields plugin exists only as a declared dependency pointing to version 5.1.1, which is much newer than the affected version (2.2.7) and the fixed version (2.2.8). Grails-core does not implement the vulnerable display ...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2019-12728",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-core@6.2.3-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:f92932fa-e1c5-5425-ad7d-bd8ec361f30b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-12728 does not affect version 6.2.3-tuxcare.9 of org.grails:grails-core. The target Grails 6.2.3 is not affected by CVE-2019-12728. The vulnerability involved using cleartext HTTP URLs for build-time Maven repository resolution, which could enable MITM attacks. The upstream vendor (Graeme Rocher) fixed this in commits a7be63abcc and 4a7c20a877 by converting all repository URLs to HTTPS and adding validation to reject HTTP URLs. These fixes were already present in the upstream Grails 6.2.3 release that TuxCare onboarded. The target's build.gradle uses only HTTPS URLs (lines 3-4, 225-231, etc.) and includes defensive validation code (lines 640-648) that throws a RuntimeException if any HTTP repository URLs are detected. No HTTP repository URLs exist in the target's build configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.3.10), NVD (< 3.3.10), Snyk (< 3.3.10).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.grails/grails-core@6.2.3-tuxcare.9"
    }
  ]
}