{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e294aa0d-7c7c-5a0f-8b9a-0e3913bbc407",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1",
      "type": "library",
      "group": "commons-collections",
      "name": "commons-collections-testframework",
      "version": "3.2-tuxcare.1",
      "purl": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:77553d08-1177-5543-a455-3a2e02dfa137",
      "id": "CVE-2015-4852",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-4852 does not affect version 3.2-tuxcare.1 of commons-collections:commons-collections-testframework. Version 3.2 is not vulnerable. Summary: The target repository contains the vulnerable functor classes (InvokerTransformer, InstantiateTransformer, etc.) that are serializable, BUT it has been patched with an effective mitigation that prevents deserialization attacks by default. The mitigation uses runtime checks via FunctorUtils.checkUnsafeSerialization() which throws UnsupportedOperationException unless explicitly enabled via system property."
      },
      "affects": [
        {
          "ref": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b35a8bd8-2906-52e1-ae97-ea97ee4ff77a",
      "id": "CVE-2015-6420",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-6420 is fixed in version 3.2-tuxcare.1 of commons-collections:commons-collections-testframework."
      },
      "affects": [
        {
          "ref": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:735b7da7-c5ec-5f12-87ff-d4eb9467ce84",
      "id": "CVE-2015-7501",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-7501 does not affect version 3.2-tuxcare.1 of commons-collections:commons-collections-testframework. Version 3.2 is not vulnerable. Summary: The target repository contains the InvokerTransformer class and related classes that are susceptible to CVE-2015-7501, but the vulnerability has been mitigated through the addition of deserialization protection guards that throw UnsupportedOperationException by default when attempting to deserialize these unsafe classes."
      },
      "affects": [
        {
          "ref": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1"
    }
  ]
}