{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4665d57e-dee3-5a85-a2ca-5303b0b8c285",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "elasticsearch-ssl-config",
      "purl": "pkg:maven/org.elasticsearch/elasticsearch-ssl-config@7.16.3-tuxcare.2",
      "type": "library",
      "group": "org.elasticsearch",
      "bom-ref": "pkg:maven/org.elasticsearch/elasticsearch-ssl-config@7.16.3-tuxcare.2",
      "version": "7.16.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "elasticsearch-ssl-config",
            "purl": "pkg:maven/org.elasticsearch/elasticsearch-ssl-config@7.16.3",
            "type": "library",
            "group": "org.elasticsearch",
            "version": "7.16.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-46674",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch-ssl-config@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7491aa7f-4e36-5821-a2dc-4a5e3020010d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46674 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch-ssl-config. not_affected \u2014 Elasticsearch 7.16.3 does not contain the ESQL datasource plugins (Parquet, ORC, Iceberg) targeted by CVE-2023-46674. The ESQL feature was introduced in Elasticsearch 8.11, released in 2023, while this target version is from 2021. The vulnerability pattern (unsafe deserialization via Hadoop Configuration) cannot manifest because the affected code paths do not exist.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.elasticsearch/elasticsearch-ssl-config@7.16.3-tuxcare.2"
    }
  ]
}