{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3cb3bba3-a662-5d7a-ace4-f0b7f2582d84",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/loopback@2.42.0-tuxcare.2",
      "type": "library",
      "name": "loopback",
      "version": "2.42.0-tuxcare.2",
      "purl": "pkg:npm/loopback@2.42.0-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:bf424ac6-6dc3-5a4c-aca4-b133f7df12ef",
      "id": "GHSA-724c-6vrf-99rq",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-724c-6vrf-99rq does not affect version 2.42.0-tuxcare.2 of loopback. already_fixed \u2014 The target repository already contains the vendor's security fix for GHSA-724c-6vrf-99rq. The type validation code that prevents query operator injection in login credentials is present in common/models/user.js (lines 218-224, 233-245) and was applied via commit 2dd98a3. The target version is 2.42.0-tuxcare.3, which includes the fix required for CVE remediation."
      },
      "affects": [
        {
          "ref": "pkg:npm/loopback@2.42.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0382ec69-a880-5cef-b3eb-c2150c3f1aa5",
      "id": "GHSA-8wgc-jjvv-cv6v",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-8wgc-jjvv-cv6v does not affect version 2.42.0-tuxcare.2 of loopback. already_fixed \u2014 The target repository (loopback 2.42.0-tuxcare.3) already contains the vendor's security fix that removes the vulnerable ACL entry allowing public AccessToken creation. The fix commit c36f9e88a372dbde10a6fe51a9394dde3bba6ab3 from upstream is present in the target's git history and is an ancestor of the current HEAD (07727be)."
      },
      "affects": [
        {
          "ref": "pkg:npm/loopback@2.42.0-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/loopback@2.42.0-tuxcare.2"
    }
  ]
}