{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:059de489-064a-5ffc-aa2a-e799360c3dd3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.26.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.26.RELEASE-tuxcare.2",
      "version": "4.3.26.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.26.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.26.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.26.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f6f10868-dea4-55b8-952a-cd982aff6044",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 XXE vulnerability is not present in Spring Framework 4.3.26.RELEASE. The upstream release already contained comprehensive XXE protections applied by Spring developers between 2013-2015, including disabling DTD processing (SUPPORT_DTD=false), disabling external entity support (IS_SUPPORTING_EXTERNAL_ENTITIES=false), and installing a no-op XML resolver. These protections were presen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.26.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e644ed98-ba3c-5974-a85b-ab81943ebbc6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 describes an XXE (XML External Entity) vulnerability in Spring Framework's Jaxb2CollectionHttpMessageConverter where an unprotected XMLInputFactory allows external entity resolution, enabling attackers to read arbitrary files. The target (Spring Framework 4.3.26.RELEASE) is NOT AFFECTED because upstream Spring developers fixed this vulnerability starting in 2013 (commit 7576274874...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.26.RELEASE-tuxcare.2"
    }
  ]
}