{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8b3c4ec8-d815-5c22-ac00-a6308888580a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "plexus-archiver",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.2.0-tuxcare.1",
      "type": "library",
      "group": "org.codehaus.plexus",
      "bom-ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.2.0-tuxcare.1",
      "version": "4.2.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "plexus-archiver",
            "purl": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.2.0",
            "type": "library",
            "group": "org.codehaus.plexus",
            "version": "4.2.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1002200",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.2.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5a0517b2-a56c-5b26-8150-143cff0c9dcb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1002200 does not affect version 4.2.0-tuxcare.1 of org.codehaus.plexus:plexus-archiver. not_affected \u2014 plexus-archiver 4.2.0 already contains the upstream Zip-Slip fix (commit 58bc24e, \"fix: fail when trying to extract outside of dest dir\"). AbstractUnArchiver.extractFile resolves the entry path and throws ArchiverException if its canonical path is not under the canonical destination directory. The fix is an ancestor of HEAD and of the first TuxCare commit (the onboarding commit), so it shipped ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-37460",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.2.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cf64e19e-f89a-56cf-a772-1062562d079c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-37460 affects version 4.2.0-tuxcare.1 of org.codehaus.plexus:plexus-archiver."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.2.0-tuxcare.1"
    }
  ]
}