{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:35db1a9d-9c81-53e4-ac64-c5ece88bd6b0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "zookeeper",
      "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.1",
      "type": "library",
      "group": "org.apache.zookeeper",
      "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.1",
      "version": "3.5.6-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "zookeeper",
            "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6",
            "type": "library",
            "group": "org.apache.zookeeper",
            "version": "3.5.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-44981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:017111c9-fe6d-56a1-abcc-97e56cee3497",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-44981 affects version 3.5.6-tuxcare.1 of org.apache.zookeeper:zookeeper."
      }
    },
    {
      "id": "CVE-2024-23944",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3333074e-b88c-5402-8db3-2896a742a204",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23944 does not affect version 3.5.6-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper version 3.5.6 is not affected by CVE-2024-23944. The vulnerability specifically targets persistent watchers (addWatch command with PERSISTENT/PERSISTENT_RECURSIVE modes), which were introduced in ZooKeeper 3.6.0. Version 3.5.6 predates this feature and does not contain the vulnerable code path. The target repository has no addWatch operation code, no AddWatchMode enum, and no persiste...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.1"
    }
  ]
}