{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8d7627e8-4dee-5487-ae28-ff605983e1f8",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/cookie@0.5.0-tuxcare.1",
      "type": "library",
      "name": "cookie",
      "version": "0.5.0-tuxcare.1",
      "purl": "pkg:npm/cookie@0.5.0-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:00afa87c-2d08-5e87-a660-002df60ffe72",
      "id": "CVE-2017-16119",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-16119 is a false positive for cookie 0.5.0-tuxcare.1. false_positive \u2014 CVE-2017-16119 is a wrong-project match. The CVE affects the 'fresh' npm package (HTTP response freshness testing), but the target repository is the 'cookie' package (HTTP cookie parsing and serialization). These are completely different npm packages with unrelated functionality. The affected component code is absent from the entire repository."
      },
      "affects": [
        {
          "ref": "pkg:npm/cookie@0.5.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:496cfc51-81e5-5bcd-8bf3-e96398461514",
      "id": "CVE-2017-18589",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-18589 is a false positive for cookie 0.5.0-tuxcare.1. false_positive \u2014 CVE-2017-18589 is a wrong-project match. The CVE affects the Rust crate 'cookie-rs' by SergioBenitez, but the target repository is the JavaScript package 'cookie' from jshttp. These are completely separate implementations in different languages by different authors, sharing only the problem domain (HTTP cookie handling)."
      },
      "affects": [
        {
          "ref": "pkg:npm/cookie@0.5.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9f44dfc4-eee6-5a5d-bced-71b6b6013f2d",
      "id": "CVE-2024-47764",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47764 is fixed in version 0.5.0-tuxcare.1 of cookie."
      },
      "affects": [
        {
          "ref": "pkg:npm/cookie@0.5.0-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/cookie@0.5.0-tuxcare.1"
    }
  ]
}