{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:869cfc5b-36d8-5c60-b25e-d3c1ccd7559a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.15",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.15",
      "version": "5.3.31-tuxcare.15",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.31",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.31"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:d2136df2-6a2c-5c51-b01d-3289abc7dbf0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 does not affect Spring Framework 5.3.31. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support (SUPPORT_DTD=false), external entity resolution (IS_SUPPORTING_EXTERNAL_ENTITIES=false), and using a no-op XML resolver. This defense is stronger than the original 2013 CVE fix and was introduced by upstream Spring de...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:ab2c711c-017f-5871-87b2-a3b46d6e36de",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.31-tuxcare.15 is NOT vulnerable to CVE-2013-7315 (XXE via StAX XMLInputFactory). The upstream vendor (Spring Framework project) fixed this vulnerability in August 2013 (commit 7576274874) by disabling external entity resolution in XMLInputFactory. This fix was already present in the upstream release that TuxCare onboarded. The target uses StaxUtils.createDefensiveInputFacto...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.15"
    }
  ]
}