{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:041c98d8-4fe4-5ca6-8a05-b77644f6c6a6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.4",
      "version": "5.2.10.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.10.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2a5e8fa4-f4ab-5fa6-bcf7-6fd95c58c7ea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.10.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 describes an XXE vulnerability in Spring Framework's OXM wrapper when using JAXB marshaller. The target version 5.2.10.RELEASE is NOT affected because comprehensive XXE protections were already present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unprotected XML entity resolution) was eliminated by upstream commit e4651d6b50 (July 2017) which refactor...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:fff3ec79-b3e0-5c2d-a91f-bd34a763f6a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.10.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 5.2.10.RELEASE. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection through SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and a NO_OP_XML_RESOLVER. This fix was introduced by upstream Spring developers (commit e4651d6b50 by Juergen Hoeller in July 2017) and was already ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.4"
    }
  ]
}