{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:09f50838-4538-5d13-bc69-1052453a8172",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.21-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.21-tuxcare.4",
      "version": "5.3.21-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.21",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.21"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1041a56b-cc01-55f8-9a8c-a5cf451da675",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.21-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework versions before 3.2.4 and 4.0.0.M1 due to XXE vulnerability in Jaxb2CollectionHttpMessageConverter when XMLInputFactory does not disable entity resolution. The target version (5.3.21) contains comprehensive XXE protections via StaxUtils.createDefensiveInputFactory() that disable DTD support, external entities, and install a no-op XML resolver. This defense...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4e60ee03-a11b-51a5-9a4a-14e5fa46b13e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.21-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is NOT present in Spring Framework 5.3.21. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and installing a no-op XML resolver. This fix was introduced by upstream Spring Framework maintainer Juergen Hoeller in commit e4651d6b50 (2017-07-20) and was already present in...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.21-tuxcare.4"
    }
  ]
}