{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:898b7716-1692-5ed5-8dee-f93e6c48ab58",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.6",
      "version": "5.0.13.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.0.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f70487c0-2213-5748-a051-35d7cf5fa1e5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.0.13.RELEASE ships with comprehensive XXE defenses that supersede the CVE-2013-4152 patch. The vulnerable pattern (unprotected XML entity processing) is not present. StaxUtils.createDefensiveInputFactory() disables DTD processing, external entity resolution, and uses a no-op XML resolver. All XML processing entry points (JAXB collections, DOMSource, SAXSource, StAXSource, Str...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:852c9a9c-c463-5738-9e77-8725b6228a7f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework versions before 3.2.4 and 4.0.0.M1-M2 where Jaxb2CollectionHttpMessageConverter did not disable external entity resolution in StAX XMLInputFactory, allowing XXE attacks. The target version 5.0.13.RELEASE is NOT affected because the upstream vendor (Spring team) fixed this vulnerability in 2013 (commit 7576274874) by disabling entity reference replacement, ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.6"
    }
  ]
}