{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c907261b-b62b-50ac-86a6-239e7cc6b80a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "grails-databinding",
      "purl": "pkg:maven/org.grails/grails-databinding@6.2.3-tuxcare.10",
      "type": "library",
      "group": "org.grails",
      "bom-ref": "pkg:maven/org.grails/grails-databinding@6.2.3-tuxcare.10",
      "version": "6.2.3-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "grails-databinding",
            "purl": "pkg:maven/org.grails/grails-databinding@6.2.3",
            "type": "library",
            "group": "org.grails",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-35912",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-databinding@6.2.3-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7a0044c6-e96d-5b5c-81ec-08a79263a5a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-35912 does not affect version 6.2.3-tuxcare.10 of org.grails:grails-databinding. not_affected \u2014 CVE-2022-35912 is NOT present in grails-core 6.2.3-tuxcare.9. The vulnerability involved Grails data-binding allowing HTTP request parameters to bind to static properties, enabling Remote Code Execution. The fix (commit 04b350371f) added a check `!Modifier.isStatic(property.modifiers)` to block binding to static properties. This fix was already present in upstream release 6.2.3 when TuxCare onb...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46131",
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-databinding@6.2.3-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:f91b0647-b8db-5a7a-8fc5-a5406424cb32",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46131 does not affect version 6.2.3-tuxcare.10 of org.grails:grails-databinding. not_affected \u2014 CVE-2023-46131 does not affect this target. The vulnerability involves Grails data binding allowing access to dangerous reflection properties (metaPropertyValues, properties, MetaProperty, CachedMethod) that can lead to JVM crash or DoS. The fix was already present in upstream Grails 6.2.3 before TuxCare onboarded this version. Commit bdf5a73ed74 by Puneet Behl (behlp@unityfoundation.io) added ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.grails/grails-databinding@6.2.3-tuxcare.10"
    }
  ]
}