{
  "@id": "urn:uuid:4bbc714f-10fd-410b-93d2-63e9167f6655",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:10:16.547418+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:09:36.787437+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.2.2-tuxcare.2 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpComponents Client 4.2.2-tuxcare.1. The vulnerability (Proxy-Authorization header leaking to origin servers) was fixed by upstream Apache in commit a572756 (Feb 2011) and shipped in version 4.1.1. The target version 4.2.2 already contained this fix when TuxCare onboarded it. The fix checks route.isTunnelled() at lines 74-77 of RequestProxyAuthentication...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpComponents Client 4.2.2-tuxcare.1. The vulnerability (Proxy-Authorization header leaking to origin servers) was fixed by upstream Apache in commit a572756 (Feb 2011) and shipped in version 4.1.1. The target version 4.2.2 already contained this fix when TuxCare onboarded it. The fix checks route.isTunnelled() at lines 74-77 of RequestProxyAuthentication..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:09:36.787437+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 is fixed in version 4.2.2-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2012-6153"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:16.547418+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 is fixed in version 4.2.2-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2013-4366"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:16.547418+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 is fixed in version 4.2.2-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2014-3577"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:09:36.787437+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 is fixed in version 4.2.2-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2015-5262"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:09:36.787437+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.2.2-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}