{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d8d1e553-b327-5a3c-b085-b37ed27fa74d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.1.9.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.9.RELEASE-tuxcare.6",
      "version": "5.1.9.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.1.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.9.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:30490bf2-3b40-5eea-a1e2-ea691b667a0a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in target Spring Framework 5.1.9.RELEASE. The upstream fix commit 7576274874 was applied in August 2013 and shipped in the upstream 5.1.9.RELEASE (May 2019) before TuxCare onboarded it. The target code uses StaxUtils.createDefensiveInputFactory() which provides even stronger XXE protections than the original patch: it disables DTD...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.9.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:bffa23c3-c8a3-549c-96b0-635f138de770",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 5.1.9.RELEASE is not affected by CVE-2013-7315. The XXE vulnerability was fixed by upstream Spring Framework developers starting with commit 7576274 in August 2013. The fix evolved over time with additional protections, culminating in StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIE...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.1.9.RELEASE-tuxcare.6"
    }
  ]
}