{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:482b5b95-c352-50e7-b674-b67ab6f6858e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.20.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.20.RELEASE-tuxcare.2",
      "version": "4.3.20.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.20.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.20.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6027b9bc-4c48-5235-984c-1139846935dc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 XXE vulnerability is NOT present in Spring Framework 4.3.20.RELEASE. The upstream fix (commit 7576274874) was already included in this release when TuxCare onboarded it. The target has comprehensive XXE protections across all JAXB HTTP message converters: Jaxb2CollectionHttpMessageConverter disables DTD support and external entities with a no-op XML resolver; Jaxb2RootElementHttpM...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:17372e34-499a-54fc-acc0-8c22e1115e8f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 4.3.20.RELEASE. The fix (commit 7576274) was already included in the upstream release when TuxCare onboarded it. The target code has comprehensive XXE protections including disabled DTD processing, disabled external entity support, and a no-op XML resolver. This is an upstream vendor fix, not a TuxCare backport.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.20.RELEASE-tuxcare.2"
    }
  ]
}