{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:76ca2c5a-46ed-58dd-8639-28c3f43dff8c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.5-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.5-tuxcare.2",
      "version": "5.3.5-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.5",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:217a17f7-c3bd-529f-be24-9ef17dde9741",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework before 3.2.4 and 4.0.0.M1 due to XXE vulnerability in the JAXB marshaller. The target (Spring Framework 5.3.5) is not affected because upstream fixes were already present in the 5.3.5 release. Jaxb2CollectionHttpMessageConverter uses StaxUtils.createDefensiveInputFactory() (disables DTD, external entities, sets no-op resolver), and Jaxb2Marshaller has proc...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1101944d-845f-5961-9279-13c15bb4edf0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC) does not affect Spring Framework 5.3.5. The upstream vendor fixed this vulnerability by introducing StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entity resolution, and setting a no-op XML resolver. This fix was already present in the upstream Spring Framework 5.3.5 release b...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.5-tuxcare.2"
    }
  ]
}