{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8b2c16c2-a88b-5c23-8160-b582ed1c6a96",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-xml",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.12-tuxcare.2",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.12-tuxcare.2",
      "version": "5.5.12-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-xml",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.12",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "5.5.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e7778d35-d6c9-5d43-bf42-3ad4d97e973e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 5.5.12-tuxcare.2 of org.springframework.integration:spring-integration-xml. The target Spring Integration 5.5.12 is not affected by CVE-2019-3772. The vulnerability affected versions up to 4.3.18, 5.0.10, and 5.1.1, with fixes released in 4.3.19, 5.0.11, and 5.1.2 respectively. Version 5.5.12 (released May 2022) is significantly newer and was released 3 years after the CVE was fixed. The XXE protection is provided by the spring-xml 3.1.3 dependency through DocumentBuilderFactoryUtils.newInstance(), which creates XML parsers with secure defaults that disable external entity processing. The fix was already in the upstream release when TuxCare onboarded version 5.5.12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.12-tuxcare.2"
    }
  ]
}