{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:88995d11-4eaf-5977-8be5-0ccbd3cb06c3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "plexus-archiver",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.4.0-tuxcare.1",
      "type": "library",
      "group": "org.codehaus.plexus",
      "bom-ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.4.0-tuxcare.1",
      "version": "4.4.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "plexus-archiver",
            "purl": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.4.0",
            "type": "library",
            "group": "org.codehaus.plexus",
            "version": "4.4.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1002200",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.4.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f325098e-89e7-5a9b-b2f7-825da28cbb4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1002200 does not affect version 4.4.0-tuxcare.1 of org.codehaus.plexus:plexus-archiver. not_affected \u2014 plexus-archiver 4.4.0 already contains the upstream Zip-Slip fix (commit 58bc24e, \"fix: fail when trying to extract outside of dest dir\"). AbstractUnArchiver.extractFile rejects any entry whose canonical path falls outside the destination directory. The fix shipped in the upstream release that TuxCare onboarded, so it is an upstream fix and not a TuxCare backport.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-37460",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.4.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f31835ec-a3a0-550a-9d5b-243ecfd8488b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-37460 affects version 4.4.0-tuxcare.1 of org.codehaus.plexus:plexus-archiver."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.plexus/plexus-archiver@4.4.0-tuxcare.1"
    }
  ]
}