{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:83b88ca6-368e-5b0d-a64c-d242ef6ff4ab",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.grails/grails-plugin-validation@2.5.6-tuxcare.2",
      "type": "library",
      "group": "org.grails",
      "name": "grails-plugin-validation",
      "version": "2.5.6-tuxcare.2",
      "purl": "pkg:maven/org.grails/grails-plugin-validation@2.5.6-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:8c72306b-0cfa-50e6-9f08-592fb004c1e5",
      "id": "CVE-2018-1000529",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-1000529 is a false positive for org.grails:grails-plugin-validation 2.5.6-tuxcare.2. false_positive \u2014 This is a wrong-project match. The CVE concerns the Grails Fields plugin (a separate, optional plugin), while the target repository is grails-core (the core Grails framework). The Fields plugin is not vendored, bundled, or present in any form within this repository."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-plugin-validation@2.5.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9a4a01b-5eb8-5431-b5e2-c5ec57624788",
      "id": "CVE-2019-12728",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-12728 does not affect version 2.5.6-tuxcare.2 of org.grails:grails-plugin-validation. already_fixed \u2014 CVE-2019-12728 addressed by TuxCare onboarding commit which removed HTTP bintray repository URL and SDKMan plugin entirely. The specific vulnerability (cleartext HTTP for SDKMan notification service) is eliminated because SDKMan components are no longer active in the build configuration."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-plugin-validation@2.5.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cca77f9c-312f-568f-ad50-41fef0e9f2a2",
      "id": "CVE-2023-46131",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-46131 is fixed in version 2.5.6-tuxcare.2 of org.grails:grails-plugin-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.grails/grails-plugin-validation@2.5.6-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.grails/grails-plugin-validation@2.5.6-tuxcare.2"
    }
  ]
}