{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ac6c6916-b71b-5631-960c-672dd7cad236",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.9-tuxcare.1",
      "version": "5.3.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.9",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7ebf8854-30e0-57c6-a872-3aecea7628e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 is an XML External Entity (XXE) vulnerability in Spring Framework's OXM wrapper when using JAXB marshaller. The target repository (Spring Framework 5.3.9) is NOT AFFECTED because an upstream fix was already present in the 5.3.9 release when TuxCare onboarded it. The fix uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD suppor...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:49668a95-d87d-5e76-b2db-12c1f3f1d38c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 5.3.9-tuxcare.3. The target uses StaxUtils.createDefensiveInputFactory() which disables external entity resolution (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false) and sets a no-op XML resolver, preventing XXE attacks. This fix was authored by upstream Spring developers (Arjen Poutsma, Juergen Hoeller) and was already ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.9-tuxcare.1"
    }
  ]
}