{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:62592ede-a95d-5006-9380-38e1160a5643",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare",
      "type": "library",
      "group": "yiisoft",
      "name": "yii2-dev",
      "version": "2.0.54-p1+tuxcare",
      "purl": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:1122be3e-99f5-5512-a78c-7dff014b61ef",
      "id": "CVE-2018-7269",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-7269 does not affect version 2.0.54-p1+tuxcare of yiisoft/yii2-dev. CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it."
      },
      "affects": [
        {
          "ref": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5f750e41-4c4b-56ad-8abe-05ea7f96d769",
      "id": "CVE-2024-32877",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-32877 does not affect version 2.0.54-p1+tuxcare of yiisoft/yii2-dev. not_affected \u2014 Target version 2.0.54 already contains the upstream fix for CVE-2024-32877. The vulnerable code pattern (using ENT_NOQUOTES in htmlEncode) was fixed in upstream Yii 2.0.50 (May 30, 2024) by changing the flag to ENT_QUOTES, which properly encodes quote characters and prevents XSS injection through HTML attributes. The fix is present in ErrorHandler.php line 185."
      },
      "affects": [
        {
          "ref": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d401737e-9406-57b0-9320-34256b3e42a2",
      "id": "CVE-2026-39850",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39850 is fixed in version 2.0.54-p1+tuxcare of yiisoft/yii2-dev."
      },
      "affects": [
        {
          "ref": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare"
    }
  ]
}