{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fb4a940b-5d3a-5f00-ae47-02dfd2bff2eb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.7-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.7-tuxcare.10",
      "version": "5.3.7-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.7",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.7-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:ecb90700-dac9-5232-a565-156b725a72ed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.7-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.7 is NOT AFFECTED by CVE-2013-4152. The XXE vulnerability was fixed in the upstream release before TuxCare onboarded version 5.3.7. The vulnerable code pattern (XMLInputFactory without external entity protection) is not present. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD processing, external entities, and installs a no-op XML resolver - a mor...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.7-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:efa45ed5-9f6a-5701-ac18-fd2427fda8b2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.7-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework versions before 3.2.4 and 4.0.0.M1-M2 due to missing XXE protection in Jaxb2CollectionHttpMessageConverter. The target (Spring Framework 5.3.7) is NOT AFFECTED because the vulnerability pattern is not present. The target's createXmlInputFactory() method uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protections (disables DTD ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.7-tuxcare.10"
    }
  ]
}