{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f4971f84-f1e3-5385-ac2b-cf03dc9eb503",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.1.13-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.13-tuxcare.3",
      "version": "6.1.13-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.1.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dad0f296-9e03-53dc-84fc-a671aab96472",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.1.13-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in Spring Framework 6.1.13-tuxcare.4. The vulnerability was fixed in upstream commit 7576274874 (2013-08-06) by apoutsma@gopivotal.com, which is an ancestor of the first TuxCare onboarding commit. The fix shipped in the upstream release. Target code uses StaxUtils.createDefensiveInputFactory() (disables DTD, external entities, use...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4c298073-1405-5801-b17c-8386ef4d6f49",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.1.13-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC's Jaxb2CollectionHttpMessageConverter) is not present in target version 6.1.13. The vulnerability was fixed in upstream Spring Framework in August 2013 (commit 7576274874deeccb6da6b09a8d5bd62e8b5538b7) by disabling external entity resolution in XMLInputFactory. The fix shipped in all subsequent Spring Framework releases including 6.1.13. Current co...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.1.13-tuxcare.3"
    }
  ]
}