{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e3186864-6fb0-584d-8b25-ab8db9ea7e7b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13",
      "version": "5.3.37-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.37"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:9e9f73fe-56a2-517d-a799-9a63fe41497f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 is not present in Spring Framework 5.3.37-tuxcare.13. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entity resolution, and setting a no-op XML resolver. This fix was already present in the upstream Spring Framework 5.3.37 release before TuxCare onboarding.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:54c02231-c552-5598-aa26-cb764349bf4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-oxm. not_affected \u2014 Target Spring Framework 5.3.37 is not affected by CVE-2013-7315. The XXE vulnerability was fixed by upstream Spring maintainers in 2015 (commit d79ec68db4), well before version 5.3.37 was released. The current code uses StaxUtils.createDefensiveInputFactory() which disables DTD support, external entity resolution, and sets a no-op XML resolver, providing comprehensive protection against XXE att...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13"
    }
  ]
}