{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:57895c75-8929-5a87-9fef-3a976b758434",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hive-hcatalog",
      "purl": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4",
      "type": "library",
      "group": "org.apache.hive.hcatalog",
      "bom-ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4",
      "version": "2.3.9-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "hive-hcatalog",
            "purl": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9",
            "type": "library",
            "group": "org.apache.hive.hcatalog",
            "version": "2.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0228",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ec55c96e-c2a7-5be5-bcbf-fc7c215c9d84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-0228 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2015-1772",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b8c8666c-a588-5269-9023-fce03a790105",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-1772 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2015-7521",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6ec250cb-d63f-598a-8d4c-5fb7a2628cd0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-7521 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2016-3083",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:bcbcd32a-3b57-5388-aa98-124feb19e3fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-3083 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2017-12625",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:435d288b-01b5-5d28-8d70-e5fa1f86e6a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12625 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2018-11777",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:edf76ae4-516e-5e5e-bdd2-84b08453e2b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11777 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2018-1282",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c01d791e-de57-54f4-9bd2-7d9b45ca1145",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1282 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2018-1284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d24255b2-bfbe-53ca-adc9-e676554b64cf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1284 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2018-1314",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:af51de75-df68-5865-ae8f-e56099d4d8be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1314 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2018-1315",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:389ab1ff-669f-5d2f-be20-f5dbfdbfded8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1315 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2020-1926",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:18933f6b-846e-5a24-8c29-7150b6b49b32",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1926 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2021-34538",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:377ebe1d-678b-5a6f-b52e-ce62c2d4594a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-34538 is fixed in version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2022-41137",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:84ce1574-eab2-50ac-bdf5-98b1b789dabe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41137 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2023-35701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1060b044-02c2-5ddb-9eb1-58bb2fb300d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-35701 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2024-23945",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4f611db5-3919-53c6-9bbe-e81e3da62dab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23945 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2024-23953",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:11663c1d-849e-5e35-b652-e0ebf6a95cea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23953 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2024-29869",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1b6416c9-c72c-5a8a-8248-97ef894a5ee1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29869 is fixed in version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2025-27888",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d2b2b4d4-5a3a-548f-8b31-aebaf807064b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27888 does not affect version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog. not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-59390",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:23850755-2e2d-5ccf-a154-2b25ee37be3f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59390 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2025-62728",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1c73b7ea-c5c7-5edb-b4b8-1cb3b58c7328",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62728 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    },
    {
      "id": "CVE-2026-55976",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:84ad4b60-99a0-5079-b851-73ae86019b71",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55976 affects version 2.3.9-tuxcare.4 of org.apache.hive.hcatalog:hive-hcatalog."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.hive.hcatalog/hive-hcatalog@2.3.9-tuxcare.4"
    }
  ]
}