{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:108146e3-3ee5-505f-b95a-a9829514ecd6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.15.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.15.RELEASE-tuxcare.1",
      "version": "5.2.15.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.15.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.15.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.15.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:db017000-1b34-5758-abb9-b51975e985f1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.15.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework versions before 3.2.4 and 4.0.0.M1 due to XML External Entity (XXE) injection in the JAXB marshaller. The target version 5.2.15.RELEASE is not affected because comprehensive XXE protections were introduced by the upstream Spring Framework team in version 5.0 (July 2017, commit e4651d6b50). The vulnerable pattern (unprotected XMLInputFactory allowing extern...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.15.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f7d56ad-a650-50ba-8d55-e160a91a26bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.15.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is NOT present in Spring Framework 5.2.15.RELEASE. The vulnerability (XXE via unprotected XMLInputFactory in Jaxb2CollectionHttpMessageConverter) was fixed by upstream Spring in August 2013 (commit 7576274874) by setting IS_REPLACING_ENTITY_REFERENCES=false. The fix evolved over subsequent releases to a more comprehensive defense (StaxUtils.createDefensiveInputFactory) that disabl...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.15.RELEASE-tuxcare.1"
    }
  ]
}