{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5904c595-dd7d-5581-b67b-3f296114daf0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.13.RELEASE-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.13.RELEASE-tuxcare.11",
      "version": "5.2.13.RELEASE-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.13.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.13.RELEASE-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:828f2e33-4d24-5992-b750-99b30aba1076",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in the target. The vulnerable code pattern has been removed by an upstream Spring Framework fix that was already included in release 5.2.13.RELEASE before TuxCare onboarded it. The target uses StaxUtils.createDefensiveInputFactory() which disables external entity resolution (sets IS_SUPPORTING_EXTERNAL_ENTITIES=false...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.13.RELEASE-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a2f3477a-c482-5b81-8440-49cde34bfc7b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework's Jaxb2CollectionHttpMessageConverter due to missing XXE protection in XMLInputFactory. The target version 5.2.13.RELEASE is NOT AFFECTED because the upstream fix was already present in the shipped release. The target uses StaxUtils.createDefensiveInputFactory() which disables external entity resolution (IS_SUPPORTING_EXTERNAL_ENTITIES=false, SUPPORT_DTD=f...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.13.RELEASE-tuxcare.11"
    }
  ]
}