{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f7637656-2f89-55a3-a05b-941f3d17a7da",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-xml",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.2.7.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.2.7.RELEASE-tuxcare.2",
      "version": "5.2.7.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-xml",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.2.7.RELEASE",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "5.2.7.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.2.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1e94b3d6-3bdd-5348-ac14-8bd90b4ea739",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework.integration:spring-integration-xml. CVE-2019-3772 affects Spring Integration 4.3.18, 5.0.10, 5.1.1, and older versions. The target (5.2.7.RELEASE) is newer and already contains the upstream fix. All XML processing classes use secure factory utilities (DocumentBuilderFactoryUtils, TransformerFactoryUtils) from spring-ws 3.0.9.RELEASE, which apply XXE protections by blocking external DTD resolution and restricting external stylesheet access. The fix was authored by Spring/Pivotal engineers and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.2.7.RELEASE-tuxcare.2"
    }
  ]
}