{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a49fa6e5-964c-58c6-a84c-8b350aa29e65",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.7",
      "version": "6.0.12-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.0.12",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fd5ef964-4d36-5a8c-acde-6a81104dde27",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.0.12-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM wrapper) is NOT present in Spring Framework 6.0.12. The upstream fix (commit 7576274874) was authored by Arjen Poutsma <apoutsma@gopivotal.com> in August 2013 and shipped in the upstream Spring Framework 6.0.12 release before TuxCare onboarded it. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protect...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:88fe33be-2430-5e48-b0cc-4123794563b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.0.12-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.0.12 uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and setting a no-op XML resolver. This fix was introduced by upstream Spring Framework in 2017 (commit e4651d6b50) and was already present in the Spring 6.0.12 release that TuxCare onboarded. The vulnerable pattern (unprotected XMLInputFac...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.7"
    }
  ]
}