{"bom":{"bomFormat":"CycloneDX","components":[{"bom-ref":"os:busybox@1.35.0","description":"BusyBox v1.35.0","name":"busybox","properties":[{"name":"syft:distro:extendedSupport","value":"false"},{"name":"syft:distro:id","value":"busybox"},{"name":"syft:distro:idLike:0","value":"busybox"},{"name":"syft:distro:prettyName","value":"BusyBox v1.35.0"},{"name":"syft:distro:versionID","value":"1.35.0"},{"name":"bomlens:licenseClass","value":"uncategorized"},{"name":"bomlens:cpeSource","value":"name-map"},{"name":"bomlens:licenseSource","value":"name-map"}],"swid":{"name":"busybox","tagId":"busybox","version":"1.35.0"},"type":"operating-system","version":"1.35.0","cpe":"cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*","licenses":[{"license":{"id":"GPL-2.0-only"}}]},{"bom-ref":"pkg:generic/busybox@1.35.0?package-id=92f706ee4bd4297f","cpe":"cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*","evidence":{"occurrences":[{"location":"NotFound"}]},"hashes":[{"alg":"SHA-1","content":"434b3b60c0514192558a00c8dc7542721ed7fe43"},{"alg":"SHA-256","content":"6e123e7f3202a8c1e9b1f94d8941580a25135382b99e8d3e34fb858bba311348"}],"name":"busybox","properties":[{"name":"syft:location:0:path","value":"/bin/busybox"},{"name":"syft:package:foundBy","value":"binary-classifier-cataloger"},{"name":"syft:package:metadataType","value":"binary-signature"},{"name":"syft:package:type","value":"binary"},{"name":"bomlens:licenseClass","value":"uncategorized"},{"name":"bomlens:licenseSource","value":"name-map"},{"name":"bomlens:originalPurl","value":"pkg:generic/busybox@1.35.0"},{"name":"bomlens:purlSource","value":"upstream-map"}],"purl":"pkg:github/mirror/busybox@1_35_0","supplier":{"name":"busybox"},"type":"application","version":"1.35.0","licenses":[{"license":{"id":"GPL-2.0-only"}}]}],"metadata":{"component":{"description":"Squashfs filesystem, little endian, version 4.0, zlib compressed, 702283 bytes, 5 inodes, blocksize: 131072 bytes, created: Wed Jul  1 22:42:54 2026","hashes":[{"alg":"SHA-256","content":"beaa28eb5824944c2e2ee174b04099302ebab7bba4d93313723fafcc29cba4b5"}],"name":"rootfs.squashfs","properties":[{"name":"bomlens:firmware:input-bytes","value":"704512"},{"name":"bomlens:firmware:recognized-regions","value":"2"},{"name":"bomlens:firmware:unknown-regions","value":"0"},{"name":"bomlens:firmware:unknown-bytes","value":"0"},{"name":"bomlens:firmware:nested-unknown-regions","value":"0"},{"name":"bomlens:firmware:unknown-top-level-percent","value":"0"},{"name":"bomlens:firmware:encrypted-regions","value":"0"},{"name":"bomlens:firmware:extraction-failed","value":"0"},{"name":"bomlens:firmware:extraction-failed-formats","value":""},{"name":"bomlens:firmware:missing-extractors","value":""}],"type":"firmware","version":"1.0.0"},"lifecycles":[{"phase":"post-build"}],"properties":[{"name":"bomlens:undeclared-fields","value":"unknown-to-author"}],"timestamp":"2026-10-14T22:37:41Z","tools":{"components":[{"name":"unblob","type":"application","version":"26.3.30"},{"name":"syft","type":"application","version":"v1.54.1"},{"name":"cve-bin-tool","type":"application","version":"3.4"},{"name":"BomLens","publisher":"SK Telecom","type":"application","version":"1.13.4"}]}},"specVersion":"1.6","version":1,"compositions":[{"aggregate":"unknown"}]},"security":{"Results":[{"Target":"CPE index (NVD)","Class":"firmware","Vulnerabilities":[{"VulnerabilityID":"CVE-2022-28391","PkgName":"busybox","InstalledVersion":"1.35.0","Severity":"HIGH","PrimaryURL":"https://nvd.nist.gov/vuln/detail/CVE-2022-28391","CVSS":{"cve-bin-tool":{"V3Score":8.8}},"source":"cve-bin-tool"},{"VulnerabilityID":"CVE-2022-30065","PkgName":"busybox","InstalledVersion":"1.35.0","Severity":"HIGH","PrimaryURL":"https://nvd.nist.gov/vuln/detail/CVE-2022-30065","CVSS":{"cve-bin-tool":{"V3Score":7.8}},"source":"cve-bin-tool"},{"VulnerabilityID":"CVE-2022-48174","PkgName":"busybox","InstalledVersion":"1.35.0","Severity":"CRITICAL","PrimaryURL":"https://nvd.nist.gov/vuln/detail/CVE-2022-48174","CVSS":{"cve-bin-tool":{"V3Score":9.8}},"source":"cve-bin-tool"},{"VulnerabilityID":"CVE-2025-46394","PkgName":"busybox","InstalledVersion":"1.35.0","Severity":"LOW","PrimaryURL":"https://nvd.nist.gov/vuln/detail/CVE-2025-46394","CVSS":{"cve-bin-tool":{"V3Score":3.2}},"source":"cve-bin-tool"},{"VulnerabilityID":"CVE-2025-60876","PkgName":"busybox","InstalledVersion":"1.35.0","Severity":"MEDIUM","PrimaryURL":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","CVSS":{"cve-bin-tool":{"V3Score":6.5}},"source":"cve-bin-tool"}]}],"SchemaVersion":2,"Trivy":{"Version":"0.75.0"},"ReportID":"01a13c90-e5d4-74cc-8c5f-d96e343950a8","CreatedAt":"2026-10-14T22:38:11.412315975Z","ArtifactName":"/tmp/tmp.LwnG6UOKZX","ArtifactType":"cyclonedx","Metadata":{"OS":{"Family":"busybox","Name":"1.35.0"}},"UncheckedComponents":{"Count":0,"Components":[]}},"scancode":null}