{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0035f633-28b4-566f-8955-8022b1e26d27",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "zookeeper",
      "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1",
      "type": "library",
      "group": "org.apache.zookeeper",
      "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1",
      "version": "3.4.10-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "zookeeper",
            "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10",
            "type": "library",
            "group": "org.apache.zookeeper",
            "version": "3.4.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-5637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:559d264e-1385-5cdb-8c88-a4bbca409c7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-5637 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper."
      }
    },
    {
      "id": "CVE-2018-8012",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e15314ce-0382-541a-9a47-1e0844ea6fd0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-8012 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. CVE-2018-8012 affects ZooKeeper versions before 3.4.10 due to lack of authentication when servers join a quorum. The target is version 3.4.10, which includes the upstream fix (ZOOKEEPER-1045, commit 8a06bd1cc) that adds quorum authentication infrastructure. The fix was authored by Apache committers and shipped in the upstream 3.4.10 release before TuxCare onboarded this version. Authentication calls are present at all connection points: Learner.java:246 (learner-side), LearnerHandler.java:168 (leader-side), and QuorumCnxManager.java:333,460 (peer connections). The vulnerable pattern (absence of authentication infrastructure) is not present in the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a576d2a7-9f0c-5f14-9b77-2f081981f477",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-0201 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper."
      }
    },
    {
      "id": "CVE-2023-44981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8e475753-0f66-5711-8292-74ca9cecb3f9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-44981 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper."
      }
    },
    {
      "id": "CVE-2024-23944",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:612b98c3-2c7e-587d-8b71-658179ad8370",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23944 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.4.10 is not affected by CVE-2024-23944. The vulnerability concerns persistent watchers (addWatch command) that allow monitoring child znodes without ACL checks at event delivery time. Version 3.4.10 does not contain the persistent watcher feature, which was introduced in ZooKeeper 3.6.0. The target only has regular (one-time) watchers that require ACL checks at registration t...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1"
    }
  ]
}