{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6097f777-cb7a-5c73-82e5-7e2c08ae5603",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.25-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.25-tuxcare.11",
      "version": "5.3.25-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.25",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.25"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.25-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a8c1612e-d54b-59c8-ab1f-5a31e65b06fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.25-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is not present in Spring Framework 5.3.25-tuxcare.11. The vulnerability was fixed in upstream commit 7576274874 (August 2013) by Arjen Poutsma, which was already included in the upstream 5.3.25 release that TuxCare onboarded. The current code uses StaxUtils.createDefensiveInputFactory() which disables DTD support, external entity resolution, and...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.25-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:481eaeea-c12f-5c27-b5a2-a20fec82e8da",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.25-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is not present in Spring Framework 5.3.25. The vulnerability affected versions before 3.2.4 where XMLInputFactory did not disable external entity resolution by default, enabling XXE attacks. The target version (5.3.25) contains the upstream fix (commit 7576274874) that was shipped in the original Spring Framework 5.3.25 release, prior to TuxCare onboarding. The fix refactored XXE ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.25-tuxcare.11"
    }
  ]
}