{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:700fe5ab-cab2-50d3-a64b-5301b6e5b4cd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-ws",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.1.5-tuxcare.1",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.1.5-tuxcare.1",
      "version": "6.1.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-ws",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.1.5",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.1.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c75e75de-e759-5e14-a8fa-63b8dfcfe1ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 6.1.5-tuxcare.1 of org.springframework.integration:spring-integration-ws. CVE-2019-3772 (XXE vulnerability in Spring Integration XML/WS modules) is NOT present in this version. The vulnerability affected Spring Integration versions 4.3.18, 5.0.10, 5.1.1 and older. The fix was applied in commit 59c69ed40d (Dec 2018) by upstream Spring Integration developer Artem Bilan, which changed XML parser initialization from unsafe `DocumentBuilderFactory.newInstance()` to secure `DocumentBuilderFactoryUtils.newInstance()` (from Spring WS). This fix was already present in upstream Spring Integration 6.1.5 when TuxCare onboarded it (commit 8f994eab9a), and remains in the current 6.1.5-tuxcare.6 version. DocumentBuilderFactoryUtils from Spring WS 4.0.8 provides XXE protection by disabling external entity processing by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.1.5-tuxcare.1"
    }
  ]
}