{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:dd8d5e63-6a81-56f6-a33b-5e078890b1f3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-ws",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.0.9-tuxcare.1",
      "version": "6.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-ws",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.0.9",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01e8bd60-2509-5fef-9dc5-7a7a01d8e900",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 6.0.9-tuxcare.1 of org.springframework.integration:spring-integration-ws. CVE-2019-3772 affects Spring Integration versions 4.3.18, 5.0.10, 5.1.1, and older due to XXE (XML External Entity) vulnerabilities in XML parsing. The target repository is Spring Integration 6.0.9-tuxcare.3. Analysis confirms the XXE fix (commit 59c69ed40d, Dec 2018) is present in the upstream 6.0.9 release that TuxCare onboarded. The vulnerable code pattern (unsafe DocumentBuilderFactory.newInstance()) has been replaced with DocumentBuilderFactoryUtils.newInstance() which provides XXE protection by default. This is an upstream fix, not a TuxCare backport. Verdict: not_affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.0.9-tuxcare.1"
    }
  ]
}