{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:15372a9e-af83-5ac1-b987-954827b06fc5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.2.19-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.19-tuxcare.2",
      "version": "6.2.19-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.2.19",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:43919fef-cd6b-5f47-b896-5c08733821a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Target Spring Framework 6.2.19 is NOT AFFECTED by CVE-2013-4152 (XXE in Spring OXM JAXB marshaller). The vulnerable pattern (unprotected XMLInputFactory allowing external entity resolution) is not present. The upstream Spring Framework project shipped comprehensive XXE defenses in the release that TuxCare onboarded, specifically via StaxUtils.createDefensiveInputFactory() which disables DTD sup...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:39f2002d-a7bc-5091-a3db-0fabab3fad9a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC) is not present in Spring Framework 6.2.19-tuxcare.3. The vulnerability was fixed in the upstream release by commit 7576274874 (author: apoutsma@gopivotal.com) in August 2013, over a decade before this version. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, an...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.2.19-tuxcare.2"
    }
  ]
}