{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:04cf466d-e1e9-5b45-a9fb-963ad66946e7",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare",
      "type": "library",
      "name": "cryptography",
      "version": "3.4.8.post1+tuxcare",
      "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:ffdae781-06c0-5b97-83fc-9d6849bbbc75",
      "id": "CVE-2023-0286",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-0286 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4a17e22c-d643-592f-b3fc-e6fbe47b215d",
      "id": "CVE-2023-23931",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca80f372-2cd9-5561-b465-2fcbf95b29d9",
      "id": "CVE-2023-3446",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-3446 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a0d98f13-e2e8-59cc-8afc-54b6a6b18bca",
      "id": "CVE-2023-49083",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-49083 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2c336797-2f28-5a9b-9bf1-7a21f6746dd4",
      "id": "CVE-2023-50782",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51dee058-dbd9-5437-88b6-d9ac906bc3cc",
      "id": "CVE-2024-0727",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-0727 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2ad663fa-86af-5ede-8da6-a1907e3f8350",
      "id": "CVE-2024-12797",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-12797 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3b502d77-9d95-5d63-acc0-ae4fd4687d18",
      "id": "CVE-2026-26007",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-26007 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:26e52cde-51da-539d-b267-b9f6e2f65ea8",
      "id": "CVE-2026-34073",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34073 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:83e34e23-6552-58f2-82c9-9f4031d9caca",
      "id": "CVE-2026-69248",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8b0bf36f-8ae7-5f8d-85dd-e5ad4be6466e",
      "id": "CVE-2026-69249",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f184f16-5efa-5aff-9798-688bddf03300",
      "id": "GHSA-537c-gmf6-5ccf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8af2ced2-6c6d-5d69-82d2-26d306169c96",
      "id": "GHSA-5cpq-8wj7-hf2v",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5cpq-8wj7-hf2v affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f7320d22-9689-5987-aadc-eca1ba253bea",
      "id": "GHSA-jm77-qphf-c4w8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-jm77-qphf-c4w8 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a24b89da-3111-52de-8e6c-e0f466587c13",
      "id": "GHSA-v8gr-m533-ghj9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 3.4.8.post1+tuxcare of cryptography."
      },
      "affects": [
        {
          "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare"
    }
  ]
}