{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8845f06e-d5af-5077-9ad9-89f039e49ee1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "flask-cors",
      "purl": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare",
      "version": "3.0.10.post1+tuxcare",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-1681",
      "affects": [
        {
          "ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a4ecbea3-1ccb-5454-93e9-96f3abd65bba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1681 is fixed in version 3.0.10.post1+tuxcare of flask-cors."
      }
    },
    {
      "id": "CVE-2024-6221",
      "affects": [
        {
          "ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8cb2a7e9-50a2-5791-b752-757fccced85e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-6221 does not affect version 3.0.10.post1+tuxcare of flask-cors. flask-cors 3.0.10 never sets Access-Control-Allow-Private-Network. The header was introduced upstream in 24070be on 2022-06-15, after 3.0.10 (May 2021), and that commit is not an ancestor of tuxcare-current/3.0.10; grep for private_network in flask_cors/ is empty. Verified by execution: a preflight carrying Access-Control-Request-Private-Network: true returns only Access-Control-Allow-Origin and Access-Control-Allow-Methods. The upstream fix 7ae310c only makes that existing header configurable, so there is nothing to backport. PYELS-158.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-6839",
      "affects": [
        {
          "ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:681db3ca-0d1c-51ea-83e0-56ead2cd92c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-6839 is fixed in version 3.0.10.post1+tuxcare of flask-cors."
      }
    },
    {
      "id": "CVE-2024-6844",
      "affects": [
        {
          "ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4fb45e5a-7610-5aae-92ed-ae72c011d945",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-6844 is fixed in version 3.0.10.post1+tuxcare of flask-cors."
      }
    },
    {
      "id": "CVE-2024-6866",
      "affects": [
        {
          "ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:06ff520a-46f5-5f05-9b68-404d51d90147",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-6866 is fixed in version 3.0.10.post1+tuxcare of flask-cors."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare"
    }
  ]
}