{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:34f7b0e4-d28d-5d18-8310-f73ed55c90dc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.5",
      "version": "4.3.9.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:6d27696f-5144-5ffa-9c6e-005f70eb753a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2013-4152 (XXE vulnerability in JAXB marshaller). The vulnerability was fixed in the upstream Spring Framework release before TuxCare onboarded version 4.3.9.RELEASE. The initial fix (commit 7576274874, August 2013) disabled entity reference replacement, and subsequent upstream commits strengthened the protection by disabling DTD support, ex...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:efe6c19e-87da-57d1-b47e-29400ff262a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC's StAX XMLInputFactory) is not present in this target. The upstream Spring Framework 4.3.9.RELEASE already included comprehensive XXE protections that exceed the original CVE-2013-7315 fix. The fix was shipped in the upstream release before TuxCare onboarded the version, making this an upstream-authored fix rather than a TuxCare backport.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.5"
    }
  ]
}