{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:13686cee-b2d6-5387-8ba4-2e311c9fa06c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1",
      "version": "8.5.46-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7d440c53-a995-5a7a-a268-9f766a401602",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-jasper. CVE-2016-5018 is not present in Tomcat 8.5.46. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions via the PrivilegedIntrospectHelper class in JspRuntimeLibrary.java, which used AccessController.doPrivileged() to execute introspection logic with elevated privileges. The upstream Apache Tomcat project removed this vulnerable code in commit 648122fef8 (authored by markt@apache.org). Version 8.5.46 includes this upstream fix\u2014the PrivilegedIntrospectHelper class and privileged execution wrapper are completely absent from the codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-2684",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:61089bbd-a5a6-5d8c-90bc-6f025571e0ce",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:02fa6ef1-5b22-52e2-aebb-412b1e15f0bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-jasper. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d4aea65e-0b08-53ab-b9f1-7b9acc1b59b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6df7fc3f-d091-59bb-8e75-354db5931e88",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.1"
    }
  ]
}