{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cf358f2a-24b7-5633-921e-022e43aa894c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.11",
      "version": "6.0.16-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.0.16",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:1c20f0af-f5b7-57a8-b48b-94a6b5cb2cd7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in Spring Framework 6.0.16. The vulnerability was fixed by upstream Spring Framework developers in July-August 2013 (commits 2c030d4dcf, 7576274874) and further enhanced in July 2017 (commit e4651d6b50). All fixes were part of the upstream release before TuxCare onboarding. The current version has comprehensive defen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9e057a4a-df5f-5cf8-950a-e99f6cff9c08",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 6.0.16. The upstream fix (commit 7576274874 by Arjen Poutsma, 2013-08-06) shipped in the upstream release. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and using a no-op XML resolver. This defense is semantically equivalent ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.11"
    }
  ]
}