{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:85560bac-b8db-5952-bcf1-f740d860e960",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.18-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.18-tuxcare.2",
      "version": "5.3.18-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.18",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:251700e3-1cad-59fb-8856-bf45c3ae545c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.18-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.18 is NOT affected by CVE-2013-4152. The target uses StaxUtils.createDefensiveInputFactory() which implements comprehensive XXE protection (disables DTD, external entities, and sets NO_OP resolver). This defense was introduced in upstream Spring Framework v4.2.0.RC2 (2015) and refactored to the current form in v5.0.0.RC3 (2017), well before the 5.3.18 release. The fix was s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6b838b11-9036-5a40-b4c5-1bda84bef519",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.18-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework before 3.2.4 and 4.0.0.M1-M2 (XXE vulnerability in XMLInputFactory). The target version is 5.3.18 (released March 2022), which already contains the upstream fix applied in August 2013 (commit 7576274874). The vulnerable pattern (unrestricted external entity resolution) is not present. The code uses StaxUtils.createDefensiveInputFactory() which disables DTD...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.18-tuxcare.2"
    }
  ]
}