{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:963edf7d-4339-52b9-bb0a-ae11ba8bb36d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.1.18-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.18-tuxcare.2",
      "version": "6.1.18-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.1.18",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:31680a19-4b5a-57ad-ad9b-8ae402383248",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in Spring Framework 6.1.18. The fix was already included in the upstream release. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD processing and external entity resolution, providing comprehensive XXE protection. Original fix commit 7576274874 (2013) and improved version e4651d6b50 (2017) a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3976c80e-c8d9-5c21-b4e9-8a659a65df8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in StAX XMLInputFactory) is not present in Spring Framework 6.1.18-tuxcare.2. The fix was already included in the upstream release that TuxCare onboarded. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection via SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and NO_OP_XML_RESOLVER. Original fix commit 757...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.1.18-tuxcare.2"
    }
  ]
}