{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f02691f5-1060-5c35-9c3f-640229c68a9e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6",
      "version": "4.3.25.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b3eb893b-c0ca-5591-970f-a96abdbe8b7b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in Spring Framework 4.3.25.RELEASE. The upstream release already shipped with comprehensive XXE protections that exceed the original CVE fix: SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and NO_OP_XML_RESOLVER. These defenses were added by upstream Pivotal developers (commits 8e096aeef5, d79ec68db4) and included in th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c9453fd6-1bbc-503b-8e18-841dffb548d9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is NOT present in Spring Framework 4.3.25.RELEASE. The vulnerable pattern (XMLInputFactory without XXE protections) was fixed by upstream Spring in commit 7576274874 (Aug 2013), which shipped in the 4.3.25.RELEASE that TuxCare onboarded. The target code contains comprehensive XXE protections: SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and a NO_OP_X...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6"
    }
  ]
}