{
  "@id": "urn:uuid:70bee1e8-74fa-4066-8b15-56b01d9f1ef9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:14:00.487878+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:20:28.152810+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.2.6-tuxcare.2 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpClient 4.2.6. The vulnerability (Proxy-Authorization headers being sent to origin servers in tunneled HTTPS connections) was fixed in upstream version 4.1.1 (February 2011) via commit a572756 by Apache developer Oleg Kalnichevski. Version 4.2.6 (September 2012) already includes this fix. The defense code at RequestProxyAuthentication.java:75-77 checks ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpClient 4.2.6. The vulnerability (Proxy-Authorization headers being sent to origin servers in tunneled HTTPS connections) was fixed in upstream version 4.1.1 (February 2011) via commit a572756 by Apache developer Oleg Kalnichevski. Version 4.2.6 (September 2012) already includes this fix. The defense code at RequestProxyAuthentication.java:75-77 checks ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:02.973774+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.2.6-tuxcare.2 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 is NOT present in this target. The vulnerability was fixed in upstream Apache HttpComponents Client 4.2.3 (CVE states \"before 4.2.3\" affected). Target version 4.2.6 was onboarded from upstream with the fix already included. The vulnerable pattern (using indexOf to find \"CN=\" anywhere in DN tokens) does not exist. Current implementation uses LdapName-based LDAP DN parsing (introduc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 is NOT present in this target. The vulnerability was fixed in upstream Apache HttpComponents Client 4.2.3 (CVE states \"before 4.2.3\" affected). Target version 4.2.6 was onboarded from upstream with the fix already included. The vulnerable pattern (using indexOf to find \"CN=\" anywhere in DN tokens) does not exist. Current implementation uses LdapName-based LDAP DN parsing (introduc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T03:14:00.487878+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.2.6-tuxcare.2 of org.apache.httpcomponents:httpclient. not_affected \u2014 Apache HttpClient 4.2.6 is not affected by CVE-2013-4366. The CVE specifically targets HttpClientBuilder.java in versions 4.3.x before 4.3.1. Version 4.2.6 predates the 4.3.x release and does not contain HttpClientBuilder.java or the associated client building architecture. The version uses the legacy DefaultHttpClient and SSLSocketFactory pattern. While SSLSocketFactory in 4.2.6 has constructo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 Apache HttpClient 4.2.6 is not affected by CVE-2013-4366. The CVE specifically targets HttpClientBuilder.java in versions 4.3.x before 4.3.1. Version 4.2.6 predates the 4.3.x release and does not contain HttpClientBuilder.java or the associated client building architecture. The version uses the legacy DefaultHttpClient and SSLSocketFactory pattern. While SSLSocketFactory in 4.2.6 has constructo..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T08:21:00.237409+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 is fixed in version 4.2.6-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2014-3577"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T08:21:00.237409+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 is fixed in version 4.2.6-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2015-5262"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T08:18:00.096502+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.2.6-tuxcare.2 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}