{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c592758b-c021-5c5a-9c76-7756780907c1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.3-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.3-tuxcare.1",
      "version": "5.3.3-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.3",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:881c6656-10ae-5c9e-b2b0-5ebba2612ea9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.3-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Target Spring Framework 5.3.3 is NOT affected by CVE-2013-4152 (XXE vulnerability). The upstream Spring Framework maintainer implemented comprehensive XXE protections in commit 8e096aeef5 (May 2014), which shipped in the upstream 5.3.3 release. The current code uses StaxUtils.createDefensiveInputFactory() which sets IS_SUPPORTING_EXTERNAL_ENTITIES=false, SUPPORT_DTD=false, and a NO_OP_XML_RESOL...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f83baf16-3622-5a3d-bcce-16d504593f5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.3-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC StAX XMLInputFactory) is not present in the target. The vulnerable pattern (unprotected XMLInputFactory allowing external entity resolution) was removed by upstream commit 7576274874 (Aug 2013) authored by Spring developer Arjen Poutsma, which added IS_REPLACING_ENTITY_REFERENCES=false. This fix was later enhanced and refactored into StaxUtils.createDefensiveInp...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.3-tuxcare.1"
    }
  ]
}