{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:997dff4e-2626-532e-84a5-f3dff2b98aab",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10",
      "version": "5.3.27-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.27",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.27"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:c059a35e-8a99-5ce5-bdc8-5ddb0341b38d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 is not present in Spring Framework 5.3.27. The XXE vulnerability fix was included in the upstream release before TuxCare onboarding. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD support and external entities (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false), providing comprehensive XXE protection beyond the original patch. Fix commit 75762748...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:994e9c26-129a-5aec-bffc-2faec09880df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC) is not present in target version 5.3.27. The vulnerable pattern (unprotected XMLInputFactory.newInstance()) was replaced by upstream Spring Framework with StaxUtils.createDefensiveInputFactory() in commit e4651d6b50 (July 2017, issue SPR-15797), which shipped in Spring 5.3.0. The target inherited this upstream fix. The defensive factory disables DTD support, ex...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10"
    }
  ]
}