{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d321e9e8-76a6-5752-b8b9-344b45f42cbc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "numpy",
      "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare",
      "version": "1.16.0.post4+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "numpy",
            "purl": "pkg:pypi/numpy@1.16.0",
            "type": "library",
            "version": "1.16.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-1858",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9a1b1ae0-ba6d-5406-824f-2bf394595863",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-1858 does not affect version 1.16.0.post4+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-1859",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6d0bd8dc-6177-54be-bae8-dd03ca40a92e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-1859 does not affect version 1.16.0.post4+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12852",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7f849e69-5622-58a9-a783-8ce98919e376",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12852 affects version 1.16.0.post4+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2019-6446",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7d39f7df-f347-57aa-93ec-14eaa310deac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-6446 is fixed in version 1.16.0.post4+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2021-33430",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ab887f57-c48a-5534-97a8-bd3c184e2710",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-33430 is fixed in version 1.16.0.post4+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2021-34141",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ea2dc1c7-7892-5520-83b7-bd5c585f4789",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-34141 is fixed in version 1.16.0.post4+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2021-41495",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:38163f66-691d-5fd7-92e1-3332d1d26192",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-41495 is fixed in version 1.16.0.post4+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2021-41496",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:60156449-8f7d-5e26-b33d-143968b1d8ea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-41496 is fixed in version 1.16.0.post4+tuxcare of numpy."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/numpy@1.16.0.post4+tuxcare"
    }
  ]
}