{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cb8a0951-58ca-5d1f-928a-02e5acf2291e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.3",
      "version": "6.2.3-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.2.3",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c5d957c2-525c-5d34-a135-91b2e78e92a7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 6.2.3-tuxcare.3 is not affected by CVE-2013-4152 (XXE vulnerability). The upstream Spring Framework fixed this vulnerability in 2017 with commit e4651d6b50, which introduced StaxUtils.createDefensiveInputFactory() providing comprehensive XXE protection (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, NO_OP_XML_RESOLVER). This fix was already present in the ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b3a32a48-165d-58d6-be3e-a3baf7e66735",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2013-7315. The upstream vendor fix was already present in the 6.2.3 release that TuxCare onboarded. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD processing, external entities, and using a no-op XML resolver - a more robust defense than the original patch which only disable...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.3"
    }
  ]
}