{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f25abd05-2824-58a3-8236-3b51ec08bbbc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina-ws", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4", "version": "7.0.70-tuxcare.4", "pedigree": { "ancestors": [ { "name": "tomcat-catalina-ws", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70", "type": "library", "group": "org.apache.tomcat", "version": "7.0.70" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2012-5568", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:d550749c-44f3-5ad3-9fed-062c0fb153b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration.", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:a3eac185-289f-5211-bce6-f6b29cc704ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5388 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:20c347a7-272e-58ff-a968-0f40ffd18e18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-8735 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2016-8745", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ac181f42-4876-53b7-bf81-ee288bc052e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-8745 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:b7581a5b-1db3-57a0-bdf3-07359fa7b747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-12616 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:8857abee-045d-5b94-b196-f444b47d41da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12617 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws, and is fixed in 7.0.70-tuxcare.5." } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:520c159a-0856-5ed2-a6ad-e54251596add", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5648 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws, and is fixed in 7.0.70-tuxcare.5." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:e8632221-6b4f-53e1-8913-acfe2f6f47de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-0221 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:7b41cd4e-3bad-537d-9f61-de4ec29da395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-2684 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:eca0361f-b64f-52ee-8c9e-d1adef0f1ae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:1392f0c8-59ed-5d78-90ba-6de1e92fcafd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. Tomcat 7.0.70 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced 4+ years later in Tomcat 9.0.40 (October 2020). Tomcat 7.0.70 only has ErrorReportValve, which outputs HTML error pages, not JSON. The attack chain requires JSON output to reach the Goal (manipulated JSON), but no JSON error reporting capability exists in this version.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:5c21de95-8ee9-5633-832e-e7cddea813f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:36013cc7-41fb-5423-8d9e-a8c1d71296a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:c0cbd693-4397-5000-816e-1de8a1069ca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:b104f221-6176-5fcc-995f-d0641f81c6be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:48de4f95-8d22-50a3-8269-f0987d220c5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:725011a0-7bf7-5466-8909-871f14fb3360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:4cf15a96-8b95-538f-baf9-b895730d3248", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52316 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. Tomcat 7.0.70 is not affected by CVE-2024-52316. This vulnerability specifically affects Jakarta Authentication (JASPIC) ServerAuthContext exception handling, but JASPIC support does not exist in Tomcat 7.x. JASPIC was introduced in Tomcat 8.5.x, and the target version (7.0.70) predates this feature entirely. The vulnerable code pattern (authenticateJaspic method catching AuthException without setting HTTP status) cannot exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:d4b5cb73-f302-565b-a748-6424c56ea3e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:2ec11a11-46f2-5b69-9e91-2dcae1cd5273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:01b3edd6-4ff1-53cc-b75e-78b4a39e1371", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31651 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. Tomcat 7.0.70 does not contain the RewriteValve component where CVE-2025-31651 exists. The vulnerability requires RewriteValve to process rewrite rules with literal special characters ('%', ';', '?'). Without this component, the attack vector cannot exist. Exhaustive search confirms no RewriteValve.java, no rewrite directory under valves, and no URL rewriting functionality. RewriteValve was introduced in Tomcat 8.5+ series (CVE affects 8.5.0-8.5.100, 9.0.0-9.0.102, 10.1.0-10.1.39, 11.0.0-11.0.5).", "justification": "code_not_present" } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:8069206d-d8ff-5289-bbfb-d4fc0d196c7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:5eb907ee-0adc-5a39-b7bf-7e5aac680035", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:4d6ebdc4-8a8e-5fbb-bd8b-36bae1d39711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:5538057a-991f-55e0-b14a-9de107593c60", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49125 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. Tomcat 7.0.70 is not affected by CVE-2025-49125. The vulnerability concerns the org.apache.catalina.webresources package (PreResources/PostResources features with insufficient path validation using startsWith without boundary checks), which was introduced in Tomcat 8.0 and does not exist in Tomcat 7.x. Tomcat 7 uses the org.apache.naming.resources DirContext architecture for resource management. While Tomcat 7 has analogous path-based resource mounting features (aliases in BaseDirContext and extraResourcePaths in VirtualDirContext), both implementations include proper boundary checks that prevent the vulnerability pattern described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:1f00d93c-9e80-578f-a380-d81e6a687972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:861549df-32a9-58b3-8b5e-3c0bb1eb2dd5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55668 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. not_affected \u2014 Tomcat 7.0.70 is not affected by CVE-2025-55668. The vulnerability exists in the RewriteValve component (org.apache.catalina.valves.rewrite.RewriteValve), which was introduced in Tomcat 8.0 and does not exist in Tomcat 7.x. Exhaustive repository search confirms no RewriteValve code is present. TuxCare's backport history corroborates this finding - CVE-2025-55668 has been backported to Tomcat 8....", "justification": "code_not_present" } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:66d40e7e-b7b9-5c4a-b3aa-97d34574d832", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:9c9718b9-e508-5284-86a0-599be1b98a7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:31cbce05-d2b6-563d-873e-dafcc540399a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:fd27efe7-bc08-5a0f-ba7b-889ad5a9f83e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25854 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. not_affected \u2014 Apache Tomcat 7.0.70 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version - it was introduced in Tomcat 8.5.30. The CVE's affected version range (8.5.30+, 9.0.0.M23+, 10.1.0-M1+, 11.0.0-M1+) correctly excludes all Tomcat 7.0.x versions. Exhaustive search of the codebase confirmed no alternative implementation of the vulnerable func...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:bdd40d55-a4ac-5d23-b02a-0c3f1900a9eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:70458c67-d687-5467-9dcb-f258863df0a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:9f411877-b32b-573b-8802-b5683d3b4f2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42498 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws. Apache Tomcat 7.0.70 is not affected by CVE-2026-42498. The vulnerability concerns exposure of HTTP authentication headers to unintended hosts during WebSocket client authentication. This version predates the introduction of WebSocket client authentication functionality, which was added between versions 7.0.82 and 7.0.83. The target lacks all authentication-related classes (Authenticator, BasicAuthenticator, DigestAuthenticator), authentication constants, and HTTP 401/407 response handling. Without the authentication feature, there are no authentication headers to expose.", "justification": "code_not_present" } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:e9c09f39-3f9b-55a5-8f60-a7b85e4725d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:741371e3-8441-52b0-a65b-a1f4e21510a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:61c3c223-670a-5311-946e-d7f81e9ef779", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:092e92ec-2f4c-536b-84b4-2028514eae6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:c1d3f1b7-885b-509b-a7db-618b431c3bb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ba705b6a-9d2a-5c62-9086-5f260cc75669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:8ece6192-63d1-567e-a967-4d47877d231f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:2dad3b22-0392-57aa-a28b-e6ad9c7f97fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ws." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@7.0.70-tuxcare.4" } ] }