{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:085c02c8-31ef-527b-9327-1c43ed93577e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "setuptools",
      "purl": "pkg:pypi/setuptools@75.0.0.post3+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare",
      "version": "75.0.0.post3+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "setuptools",
            "purl": "pkg:pypi/setuptools@75.0.0",
            "type": "library",
            "version": "75.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-40897",
      "affects": [
        {
          "ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4e52350c-ffc0-56a4-83b4-b3a953f47e83",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-40897 does not affect version 75.0.0.post3+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-6345",
      "affects": [
        {
          "ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:db894c34-b9d3-54d1-91e6-43ab1fe8af6e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6345 affects version 75.0.0.post3+tuxcare of setuptools."
      }
    },
    {
      "id": "CVE-2025-47273",
      "affects": [
        {
          "ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5688348b-ac3c-5be0-a217-9fa387b3f54e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-47273 is fixed in version 75.0.0.post3+tuxcare of setuptools."
      }
    },
    {
      "id": "CVE-2026-59890",
      "affects": [
        {
          "ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2a4458ec-b91c-5b95-8c7e-22eab076cfc9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59890 is fixed in version 75.0.0.post3+tuxcare of setuptools."
      }
    },
    {
      "id": "GHSA-xmj3-9gf7-h52w",
      "affects": [
        {
          "ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:829047cb-8f3c-54be-a3a3-ed982d1e3754",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-xmj3-9gf7-h52w is fixed in version 75.0.0.post3+tuxcare of setuptools."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/setuptools@75.0.0.post3+tuxcare"
    }
  ]
}