{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d45253be-db2d-5346-9d7b-a60436c7ffb8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.4.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.4.RELEASE-tuxcare.6",
      "version": "4.3.4.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.4.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.4.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.4.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5daa7a44-3032-56c1-8211-0061f54893ce",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2013-4152 (XXE vulnerability in OXM wrapper). The upstream vendor (Pivotal/VMware) fixed this vulnerability in July-August 2013 through commits 2c030d4d and 7576274, both of which shipped in the 4.3.4.RELEASE version before TuxCare onboarded it. Both affected components (Jaxb2Marshaller and Jaxb2CollectionHttpMessageConverter) have external ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.4.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:64f1c7d2-5625-5b69-b2f0-ead180eac3f7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC StAX XMLInputFactory) is NOT present in Spring Framework 4.3.4.RELEASE. The vulnerable pattern (unprotected XMLInputFactory allowing external entity resolution) was fixed by upstream Spring Framework developers before this version was released. The target contains three layers of XXE defense: IS_SUPPORTING_EXTERNAL_ENTITIES=false, SUPPORT_DTD=false...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.4.RELEASE-tuxcare.6"
    }
  ]
}