{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ee7d308d-6e9a-5412-a765-d8744d93182d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-ws",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.4.10-tuxcare.8",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.4.10-tuxcare.8",
      "version": "6.4.10-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-ws",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-ws@6.4.10",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.4.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bbbc4ebe-baa0-5ade-97ce-85ea7a3cc8ee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-ws. Spring Integration 6.4.10 is not affected by CVE-2019-3772 (XXE vulnerability). The vulnerability affected versions up to 4.3.18, 5.0.10, and 5.1.1. The fix was applied upstream in December 2018 (commit 59c69ed40d37) by replacing insecure DocumentBuilderFactory.newInstance() with secure DocumentBuilderFactoryUtils.newInstance() throughout spring-integration-xml and spring-integration-ws modules. This fix was already present in the upstream 6.4.10 release when TuxCare onboarded it in June 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-ws@6.4.10-tuxcare.8"
    }
  ]
}