{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:076d0722-ccf1-5177-a53d-94e42964e607",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/hawk@1.0.0",
      "type": "library",
      "name": "hawk",
      "version": "1.0.0",
      "purl": "pkg:npm/hawk@1.0.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:83d4256c-8f74-5bbf-b98f-502cadecdee0",
      "id": "CVE-2017-20162",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-20162 is a false positive for hawk 1.0.0. false_positive \u2014 CVE-2017-20162 concerns the 'ms' time conversion library by vercel/zeit, not the 'hawk' HTTP authentication library. The target repository is an entirely different product with no dependency on or vendored copy of the ms package."
      },
      "affects": [
        {
          "ref": "pkg:npm/hawk@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e6ec87c-77b0-5d2a-bda3-1518dbc4505c",
      "id": "CVE-2018-3739",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-3739 is a false positive for hawk 1.0.0. false_positive \u2014 CVE-2018-3739 affects the npm package 'https-proxy-agent', but the target repository is 'hawk' (HTTP Hawk Authentication Scheme). These are completely different projects with different purposes. The target repository contains no code from https-proxy-agent, neither as the project itself, as a vendored copy, nor as a declared dependency."
      },
      "affects": [
        {
          "ref": "pkg:npm/hawk@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:92e4a7b0-da59-5984-8c98-4d8c12da01e6",
      "id": "CVE-2021-33623",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-33623 is a false positive for hawk 1.0.0. false_positive \u2014 CVE-2021-33623 concerns the trim-newlines package, which is not present in this hawk repository. This is a wrong-project match - the advisory was matched to an unrelated product."
      },
      "affects": [
        {
          "ref": "pkg:npm/hawk@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:440b1beb-21b4-5356-8d57-0c25592d9c43",
      "id": "CVE-2024-47178",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-47178 does not affect version 1.0.0 of hawk. already_fixed \u2014 The target repository (hawk 1.0.0-tuxcare.1) already contains the fix for the timing attack vulnerability via the Cryptiles.fixedTimeComparison function. Note: CVE-2024-47178 description mentions 'basic-auth-connect' but the provided patch and target repository are both for 'hawk' - this appears to be a CVE metadata error."
      },
      "affects": [
        {
          "ref": "pkg:npm/hawk@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9fc9081-6d38-5a9e-90fb-0bd1d9395f32",
      "id": "GHSA-pc5p-h8pf-mvwp",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-pc5p-h8pf-mvwp is a false positive for hawk 1.0.0. false_positive \u2014 The CVE GHSA-pc5p-h8pf-mvwp concerns the https-proxy-agent package, but the target repository is the hawk package (HTTP Hawk Authentication Scheme). These are entirely different npm packages with different purposes. The hawk package is an HTTP authentication library, while https-proxy-agent handles HTTPS connections through proxies. No code from https-proxy-agent is present in this repository a..."
      },
      "affects": [
        {
          "ref": "pkg:npm/hawk@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4772b853-1313-5e21-8e32-751ccc89773c",
      "id": "GHSA-qrg3-f6h6-vq8q",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-qrg3-f6h6-vq8q is a false positive for hawk 1.0.0."
      },
      "affects": [
        {
          "ref": "pkg:npm/hawk@1.0.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/hawk@1.0.0"
    }
  ]
}