{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:91d1eb6c-a551-5575-9da0-05c19a838436",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.30-tuxcare.12",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.30-tuxcare.12",
      "version": "5.3.30-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.30",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.30"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.30-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:dbfa2e1a-52ec-508e-b389-cd6cd2af8e31",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.30-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) does not affect Spring Framework 5.3.30-tuxcare.12. The upstream fix was introduced in commit 7576274 (Aug 2013) by Arjen Poutsma and shipped in Spring Framework 3.2.4. The target version (5.3.30) is significantly newer and contains comprehensive XXE defenses through StaxUtils.createDefensiveInputFactory(), which disables DTD suppo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.30-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:3d311964-6aa1-5d3a-bac7-15bcc151dbbc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.30-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is not present in Spring Framework 5.3.30. The vulnerability pattern (unprotected XMLInputFactory allowing external entity resolution) was fixed in the upstream Spring Framework release that TuxCare onboarded. The target uses StaxUtils.createDefensiveInputFactory() which sets comprehensive XXE protections: SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and NO_OP_XML_RES...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.30-tuxcare.12"
    }
  ]
}