{
  "@id": "urn:uuid:9f0d44ea-0906-4475-9194-6eaa3bd9efdf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:43:00.053577+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:42:01.482212+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.2.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target version 4.2.5 is NOT affected by CVE-2011-1498. The vulnerability (Proxy-Authorization header leakage to origin servers during tunneled connections) was fixed in upstream release 4.1.1 by commit a572756592c969 authored by Apache developer Oleg Kalnichevski. Version 4.2.5 (released after 4.1.1) inherited this fix from the upstream codebase. The defense code that checks for tunneled routes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 Target version 4.2.5 is NOT affected by CVE-2011-1498. The vulnerability (Proxy-Authorization header leakage to origin servers during tunneled connections) was fixed in upstream release 4.1.1 by commit a572756592c969 authored by Apache developer Oleg Kalnichevski. Version 4.2.5 (released after 4.1.1) inherited this fix from the upstream codebase. The defense code that checks for tunneled routes..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:42:01.482212+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.2.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 is NOT present in Apache HttpComponents Client 4.2.5. The vulnerability affected versions before 4.2.3, and the fix was included in the upstream 4.2.5 release. The target uses LdapName-based DN parsing (introduced by CVE-2014-3577 backport) which properly extracts only actual CN attributes, not arbitrary fields containing \"CN=\" in their values. The vulnerable string-tokenization p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 is NOT present in Apache HttpComponents Client 4.2.5. The vulnerability affected versions before 4.2.3, and the fix was included in the upstream 4.2.5 release. The target uses LdapName-based DN parsing (introduced by CVE-2014-3577 backport) which properly extracts only actual CN attributes, not arbitrary fields containing \"CN=\" in their values. The vulnerable string-tokenization p..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:43:00.053577+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 is fixed in version 4.2.5-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2013-4366"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:43:00.053577+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 is fixed in version 4.2.5-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2014-3577"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:42:11.755781+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 is fixed in version 4.2.5-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2015-5262"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:43:00.053577+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.2.5-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}