{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8b8026f0-077f-5fc0-b926-67408a0f7ee7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "cryptography",
      "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare",
      "version": "42.0.0.post3+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "cryptography",
            "purl": "pkg:pypi/cryptography@42.0.0",
            "type": "library",
            "version": "42.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-0727",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d3822f6f-2b8a-5f4f-adaf-bdb1f7f28a92",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-0727 affects version 42.0.0.post3+tuxcare of cryptography."
      }
    },
    {
      "id": "CVE-2024-12797",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:334708e8-c5e8-5390-9586-99710b85c5cc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-12797 is fixed in version 42.0.0.post3+tuxcare of cryptography."
      }
    },
    {
      "id": "CVE-2024-26130",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:91998306-76ac-5301-8fef-9afb52dfbae5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-26130 is fixed in version 42.0.0.post3+tuxcare of cryptography."
      }
    },
    {
      "id": "CVE-2026-26007",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:526b698b-f47d-57ad-9666-f31848df2e52",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-26007 is fixed in version 42.0.0.post3+tuxcare of cryptography."
      }
    },
    {
      "id": "CVE-2026-34073",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a3bd672c-2d0d-5e66-bfa5-b0d80cd65d22",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34073 affects version 42.0.0.post3+tuxcare of cryptography."
      }
    },
    {
      "id": "CVE-2026-69248",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:90c620e2-9e97-5473-8e67-a4cd732e71e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-69248 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69249",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:db6abfa9-fbea-5b45-a70c-d80ff2ad126c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69249 is fixed in version 42.0.0.post3+tuxcare of cryptography."
      }
    },
    {
      "id": "GHSA-537c-gmf6-5ccf",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b1418885-369f-55c2-b7b5-c38ce8dffecb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "GHSA-h4gh-qq45-vh27",
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8f7e456a-250d-564c-af66-8bfa77209b0c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi...",
        "justification": "requires_dependency"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/cryptography@42.0.0.post3+tuxcare"
    }
  ]
}