{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a21ec9e3-939a-5d78-be81-05f1167cdb4b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.0.0-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.0-tuxcare.5",
      "version": "6.0.0-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.0.0",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.0-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d7e7cacf-36b9-57ec-869e-caecccd55f12",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.0.0-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 describes XXE vulnerability in Spring OXM wrapper when using JAXB marshaller. The target (Spring Framework 6.0.0) is not affected because comprehensive XXE protections were implemented upstream long before this version was released. The fix evolved from the original 2013 patch (disabling entity reference replacement) to a more robust 2017 implementation using StaxUtils.createDefen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.0-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:fdc615f3-bc7b-54a8-a7ba-c8253555ca52",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.0.0-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is NOT present in Spring Framework 6.0.0. The vulnerability concerns unprotected XMLInputFactory allowing XXE attacks via external entity resolution. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD support (SUPPORT_DTD=false), blocks external entities (IS_SUPPORTING_EXTERNAL_ENTITIES=false), and uses a no-op XMLResolver. This comprehensive defense was au...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.0.0-tuxcare.5"
    }
  ]
}