{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3acac608-7525-5f51-a2af-4938eead3dcf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.20-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.20-tuxcare.2",
      "version": "5.3.20-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.20",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.20"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.20-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:19889bef-b87b-57da-b91d-4c1bad0210a9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in Spring Framework 5.3.20. The upstream vendor (Pivotal/VMware) already installed comprehensive XXE defenses that shipped with this release. All XML input factories disable DTD support and external entity resolution by default via StaxUtils.createDefensiveInputFactory() and equivalent protections across SourceHttpMessageConverter...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.20-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee402b9c-294f-56cd-89e8-e6ed8f5d3d75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC StAX XMLInputFactory) is not present in Spring Framework 5.3.20. The vulnerable pattern was fixed by upstream Spring developers in commit e4651d6b50 (July 2017), which introduced StaxUtils.createDefensiveInputFactory() with comprehensive XXE protections (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, NO_OP_XML_RESOLVER). This fix shipped in Spring 5.0...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.20-tuxcare.2"
    }
  ]
}