{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:73db2f51-3e02-5184-8165-80ffb1e12d4d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.0.13-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.13-tuxcare.5",
      "version": "6.0.13-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.0.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.13-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:19503df7-17e9-5f0c-a21a-8070b6f67689",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.0.13-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT PRESENT in Spring Framework 6.0.13-tuxcare.6. The target contains an upstream fix that was shipped in the Spring Framework 6.0.13 release before TuxCare onboarded it. The vulnerable code path uses `StaxUtils.createDefensiveInputFactory()` which provides comprehensive XXE protection by disabling external entities, DTDs, and s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.13-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e0e78c7d-263f-5bd6-a2af-fca0ee931a3f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.0.13-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 6.0.13 is not affected by CVE-2013-7315. The XXE vulnerability was fixed in upstream commit 7576274874 (authored by Arjen Poutsma, Aug 2013), which was already present in the upstream release 6.0.13 that TuxCare onboarded. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entit...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.0.13-tuxcare.5"
    }
  ]
}