{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:376a5d96-010a-5298-8e9a-1dfafd11a283",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "commons-compress",
      "purl": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1",
      "type": "library",
      "group": "org.apache.commons",
      "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1",
      "version": "1.4.1-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-11771",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:981fd102-7303-55d6-9cc3-e182ff410a38",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11771 is fixed in version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d72619f5-d02b-51e8-9687-68f8dbd77f75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-35515 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.4.1 is not affected by CVE-2021-35515. The vulnerability exists in the SevenZ (7Z) archive format handler's codec chain traversal logic, but version 1.4.1 does not include SevenZ support. The entire sevenz package was added in a later version (present in 1.18+). TuxCare backported fixes to versions 1.18, 1.19, and 1.20, but version 1.4.1 predates the SevenZ fea...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-35516",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:09d1e3b0-06b4-58b6-a61b-64677541f817",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-35516 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.4.1 is not affected by CVE-2021-35516. This version predates the introduction of 7Z archive support and contains no code capable of parsing 7Z archives. The vulnerability requires processing specially crafted 7Z archive metadata, but version 1.4.1 only supports ar, cpio, dump, jar, tar, and zip formats.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-35517",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7d2cbcce-6d50-5303-aa24-dcc668c202c9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-35517 affects version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-36090",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:deb56744-f381-5618-bb58-5c12dae2509f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-36090 affects version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2024-25710",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:61122077-e19b-5107-84b0-e1bce6fb2f0e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1"
    }
  ]
}