{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9c20296a-19b8-5423-9d10-d3857234f4e9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.1.8.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.8.RELEASE-tuxcare.3",
      "version": "5.1.8.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.1.8.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.8.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.8.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8e2c67da-1b21-509c-93a0-2afa646e024d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 is an XXE (XML External Entity) vulnerability in Spring Framework's JAXB marshaller that allowed attackers to read arbitrary files via external entity declarations. The target version 5.1.8.RELEASE is NOT AFFECTED because it contains a comprehensive upstream fix that was already present in the release before TuxCare onboarding. The vulnerable code pattern (unprotected XMLInputFact...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.8.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:95f0dcc2-1084-5121-8e52-c0142b31e8d7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is not present in Spring Framework 5.1.8.RELEASE. The vulnerability was fixed by upstream Spring developers in commits 2ae6a6a341 (Nov 2013) and edba32b3093 (Feb 2014), both of which are ancestors of the v5.1.8.RELEASE tag. The fix disables external entity processing by default in XMLInputFactory via the IS_SUPPORTING_EXTERNAL_ENTITIES property and sets NO_OP_XML_RESOLVER when ext...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.1.8.RELEASE-tuxcare.3"
    }
  ]
}