{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:37212c22-1929-5507-8bd8-35c669c78452",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.21.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.21.RELEASE-tuxcare.5",
      "version": "4.3.21.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.21.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.21.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.21.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d2e8b4c4-0afe-558a-b214-80d2232afc1b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 4.3.21.RELEASE is not affected by CVE-2013-4152 (XXE vulnerability in JAXB marshallers). The fix was already present in the upstream release when TuxCare onboarded it. All three main JAXB components (Jaxb2CollectionHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2Marshaller) have comprehensive XXE protections enabled by default, including disabled ext...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.21.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1e4cc0f0-e8b1-5639-882d-a673a8925540",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2013-7315. The vulnerable code pattern (XMLInputFactory without external entity protection) is not present in this version. The upstream Spring Framework already included comprehensive XXE protections (IS_SUPPORTING_EXTERNAL_ENTITIES=false, SUPPORT_DTD=false, NO_OP_XML_RESOLVER) before TuxCare onboarded version 4.3.21.RELEASE. The fix was s...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.21.RELEASE-tuxcare.5"
    }
  ]
}