{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:459971bb-2c98-5049-9915-b6eab0e1be89",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-xml",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.1.13.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.1.13.RELEASE-tuxcare.1",
      "version": "5.1.13.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-xml",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.1.13.RELEASE",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "5.1.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.1.13.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0d8b8b7f-ea53-5726-a934-cddc5655c5e9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework.integration:spring-integration-xml. CVE-2019-3772 (XXE vulnerability in Spring Integration XML modules) is NOT present in target version 5.1.13.RELEASE. The vulnerability was fixed in upstream version 5.1.2.RELEASE (commit 59c69ed40d by Artem Bilan, December 2018) before TuxCare onboarded 5.1.13.RELEASE. All XML parsing code now uses secure Spring XML utilities (DocumentBuilderFactoryUtils.newInstance() and TransformerFactoryUtils.newInstance()) that disable external entity processing by default, eliminating the XXE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.1.13.RELEASE-tuxcare.1"
    }
  ]
}