{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:86eb0308-aeee-5483-8ab5-12e653404b90",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.11.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.11.RELEASE-tuxcare.4",
      "version": "5.2.11.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.11.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.11.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.11.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8cac6f8c-927d-5d70-99ab-fed6cba7e4f3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.11.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 5.2.11.RELEASE is not affected by CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller). The vulnerable pattern (XMLInputFactory without external entity protection) is not present in the target. The file Jaxb2CollectionHttpMessageConverter.java uses StaxUtils.createDefensiveInputFactory() which disables DTD support, external entity resolution, and uses a no...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.11.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b557a3c7-05a5-5126-b0a7-0d7e38e048fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.11.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework before 3.2.4 and 4.0.0.M1-M2 due to missing XXE protection in Jaxb2CollectionHttpMessageConverter. The target version 5.2.11.RELEASE contains the upstream fix (commit 7576274874, Aug 2013) which was later enhanced and refactored to use StaxUtils.createDefensiveInputFactory(). This defensive factory disables DTD processing, external entities, and entity res...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.11.RELEASE-tuxcare.4"
    }
  ]
}