{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c23588c4-da10-5a38-8ded-b0b71d0fec89",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bson",
      "purl": "pkg:npm/bson@0.5.7-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/bson@0.5.7-tuxcare.3",
      "version": "0.5.7-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "bson",
            "purl": "pkg:npm/bson@0.5.7",
            "type": "library",
            "version": "0.5.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-4411",
      "affects": [
        {
          "ref": "pkg:npm/bson@0.5.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a0bb8d2c-3345-59de-b6f8-fcd40bab7be9",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2015-4411 is a false positive for bson 0.5.7-tuxcare.3. false_positive \u2014 CVE-2015-4411 concerns the Ruby library mongodb/bson-ruby (specifically the Moped::BSON::ObjectId.legal? method), but the target repository is mongodb/js-bson, a JavaScript/Node.js library. These are separate projects in different programming languages with independent codebases. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2015-4412",
      "affects": [
        {
          "ref": "pkg:npm/bson@0.5.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7c277d9c-53c9-5b1e-87e3-1d7a045d4155",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2015-4412 is a false positive for bson 0.5.7-tuxcare.3. false_positive \u2014 CVE-2015-4412 is a wrong-project match. The CVE concerns bson-ruby (Ruby gem), but this repository is js-bson (JavaScript/Node.js package). These are completely different projects despite having similar names and purposes."
      }
    },
    {
      "id": "CVE-2018-13863",
      "affects": [
        {
          "ref": "pkg:npm/bson@0.5.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dc45d52c-298c-5eb9-9eaa-af303c0be95e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-13863 is fixed in version 0.5.7-tuxcare.3 of bson."
      }
    },
    {
      "id": "CVE-2019-2391",
      "affects": [
        {
          "ref": "pkg:npm/bson@0.5.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:daea16d4-2179-5de3-90a3-3201db3d4a42",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-2391 is fixed in version 0.5.7-tuxcare.3 of bson."
      }
    },
    {
      "id": "CVE-2020-7610",
      "affects": [
        {
          "ref": "pkg:npm/bson@0.5.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dd276e36-9ea5-56d2-8f15-7e3c941ce46c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-7610 is fixed in version 0.5.7-tuxcare.3 of bson."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/bson@0.5.7-tuxcare.3"
    }
  ]
}