{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:df2e04f5-030f-52c3-b0d7-0e34b1f4ebee",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "grails-databinding",
      "purl": "pkg:maven/org.grails/grails-databinding@6.2.1-tuxcare.4",
      "type": "library",
      "group": "org.grails",
      "bom-ref": "pkg:maven/org.grails/grails-databinding@6.2.1-tuxcare.4",
      "version": "6.2.1-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "grails-databinding",
            "purl": "pkg:maven/org.grails/grails-databinding@6.2.1",
            "type": "library",
            "group": "org.grails",
            "version": "6.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-35912",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-databinding@6.2.1-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c63b896d-c523-5a61-8fae-9beff96d2b55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-35912 does not affect version 6.2.1-tuxcare.4 of org.grails:grails-databinding. not_affected \u2014 CVE-2022-35912 describes a Remote Code Execution vulnerability in Grails data-binding logic that allows attackers to manipulate static properties. The target version (6.2.1) is NOT AFFECTED because the fix was already present in the upstream Grails 6.2.1 release. The fix adds a check `!Modifier.isStatic(property.modifiers)` in SimpleDataBinder.isOkToBind() at line 270, preventing data binding t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46131",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-databinding@6.2.1-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8e6e4a75-cc9e-511c-b9fe-655fe7456181",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46131 does not affect version 6.2.1-tuxcare.4 of org.grails:grails-databinding. not_affected \u2014 CVE-2023-46131 is not present in grails-core 6.2.1-tuxcare.4. The vulnerability was fixed upstream in Grails by adding blacklist checks for 'metaPropertyValues' and 'properties' property names, and type checks for MetaProperty and CachedMethod classes in SimpleDataBinder.groovy. This fix was already present in the Grails 6.2.1 release that TuxCare onboarded (commit bdf5a73ed743792ddcc067e2b4450...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.grails/grails-databinding@6.2.1-tuxcare.4"
    }
  ]
}