{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ef2479f9-f8e5-5121-8b99-5628dbb681c9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-ws",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.3.11-tuxcare.5",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.3.11-tuxcare.5",
      "version": "6.3.11-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-ws",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.3.11",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.3.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.3.11-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:fe4c55a3-3a38-52da-872f-36af1f715f43",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 6.3.11-tuxcare.5 of org.springframework.integration:spring-integration-ws. CVE-2019-3772 describes XXE vulnerability in Spring Integration XML modules (spring-integration-xml and spring-integration-ws) affecting versions 4.3.18, 5.0.10, 5.1.1 and older. The target version 6.3.11 is NOT affected because the upstream fix (commit 59c69ed40d by Artem Bilan, December 2018) was already present in the upstream Spring Integration 6.3.11 release when TuxCare onboarded it. All XML parsing in the target uses DocumentBuilderFactoryUtils.newInstance() and TransformerFactoryUtils.newInstance() from Spring's spring-xml library, which provide XXE-safe defaults by disabling external entity resolution. The vulnerable pattern (direct DocumentBuilderFactory.newInstance() without XXE protection) is not present in any production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.3.11-tuxcare.5"
    }
  ]
}