{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8d443e0d-25ab-5311-bd9d-20b158aa1488",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1",
      "version": "4.5.11-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ebb7e475-53d1-5fa0-908b-b40c9df8af4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.5.11-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 HttpClient 4.5.11 already contains the upstream fix for CVE-2011-1498 (HTTPCLIENT-1061). Proxy-Authorization is not generated for tunnelled routes, so it is not sent to the origin server. The fix commit a572756 is by olegk@apache.org and is part of the upstream 4.5.11 release, before the first TuxCare commit.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8e9eb67c-667e-50b8-8571-b5c7f0ba52e3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6153 does not affect version 4.5.11-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target (HttpClient 4.5.11) is not affected by CVE-2012-6153. The flaw was ad-hoc string splitting of the certificate subject DN to find the CN. The shipped code parses the DN with javax.naming.ldap.LdapName and takes only genuine 'cn' attributes. This was introduced upstream by Apache (olegk@apache.org), commit 196ac3f3, long before the first TuxCare commit (the 4.5.11 onboarding).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:184496ff-7f99-56fe-b122-9db8f7afdb80",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4366 does not affect version 4.5.11-tuxcare.1 of org.apache.httpcomponents:httpclient. httpcomponents-client 4.5.11 is not affected by CVE-2013-4366. The vulnerability affects HttpClientBuilder in Apache HttpClient 4.3.x before 4.3.1. The upstream fixes 08140864e (SVN r1528614) and d9e2140b1 (SVN r1528447), 'Ensure X509HostnameVerifier is never null', are ancestors of tuxcare-current/4.5.11. HttpClientBuilder falls back to DefaultHostnameVerifier when no verifier is set, and SSLConnectionSocketFactory always calls verify(), so the vulnerable code is not present.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b7894779-89ea-5400-b967-ad1c8c5b6658",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3577 does not affect version 4.5.11-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target is HttpClient 4.5.11. The CVE-2014-3577 flaw (regex-based CN extraction from the subject DN, spoofable with \"foo,CN=www.apache.org\" in the O field) is not present. CN extraction parses the DN with javax.naming.ldap.LdapName/Rdn and only reads real \"cn\" attributes. This came with the upstream release: commit 196ac3f3 by olegk@apache.org (2014) is an ancestor of the first TuxCare commit, t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dcb754db-0742-53ec-95b3-c0b315c29ba4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5262 does not affect version 4.5.11-tuxcare.1 of org.apache.httpcomponents:httpclient. Prechecker: The upstream fix is already in this version's source history (commits 09027e72, 1d09a830). Version 4.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-fmj5-wv96-r2ch (affected up to 4.3.6), NVD (affected up to 4.3.5), Snyk (affected up to 4.3.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:65d2941f-fc72-548b-9d6d-915b4c0d8d36",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.5.11-tuxcare.1 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.11-tuxcare.1"
    }
  ]
}