{
  "@id": "urn:uuid:27b77cd5-881b-4f50-9964-abcbbf5946db",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:08:00.040909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:19:00.073279+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.10-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Apache HttpClient 4.5.10 is not affected by CVE-2011-1498. The vulnerability was fixed in upstream version 4.1.1 (February 2011) and the fix is present in version 4.5.10. The defense prevents Proxy-Authorization headers from being sent to destination servers when using tunnelled connections (HTTPS through proxy) by checking route.isTunnelled() before adding proxy authentication headers. This pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 Apache HttpClient 4.5.10 is not affected by CVE-2011-1498. The vulnerability was fixed in upstream version 4.1.1 (February 2011) and the fix is present in version 4.5.10. The defense prevents Proxy-Authorization headers from being sent to destination servers when using tunnelled connections (HTTPS through proxy) by checking route.isTunnelled() before adding proxy authentication headers. This pr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:40:27.455401+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.10-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target is NOT AFFECTED by CVE-2012-6153. The vulnerability was fixed by upstream Apache before the 4.5.10 release that TuxCare onboarded. The vulnerable CN extraction code (using indexOf(\"CN=\") that matches anywhere in DN tokens) has been replaced with secure JNDI LdapName-based parsing (commit 6e14fc146 by olegk@apache.org, Nov 2012). The wildcard parsing bug (using parts.length-2 instead of p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 Target is NOT AFFECTED by CVE-2012-6153. The vulnerability was fixed by upstream Apache before the 4.5.10 release that TuxCare onboarded. The vulnerable CN extraction code (using indexOf(\"CN=\") that matches anywhere in DN tokens) has been replaced with secure JNDI LdapName-based parsing (commit 6e14fc146 by olegk@apache.org, Nov 2012). The wildcard parsing bug (using parts.length-2 instead of p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:08:00.040909+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.10-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder.java doesn't ensure X509HostnameVerifier is not null, potentially allowing hostname verification bypass. The target version 4.5.10 includes the upstream fix (commit 08140864e from October 2013) that ensures a default hostname verifier is initialized when null. This fix was authored by Apache committer Oleg Kalni...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder.java doesn't ensure X509HostnameVerifier is not null, potentially allowing hostname verification bypass. The target version 4.5.10 includes the upstream fix (commit 08140864e from October 2013) that ensures a default hostname verifier is initialized when null. This fix was authored by Apache committer Oleg Kalni..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:43:06.698465+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.10-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 affects Apache HttpClient versions before 4.3.5 due to improper CN extraction from X.509 certificates using naive string tokenization. Target version 4.5.10 is NOT affected - it ships with the upstream fix already in place. The vulnerable StringTokenizer-based parsing was replaced with proper LDAP name parsing using javax.naming.ldap.LdapName and Rdn classes in DefaultHostnameVeri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 affects Apache HttpClient versions before 4.3.5 due to improper CN extraction from X.509 certificates using naive string tokenization. Target version 4.5.10 is NOT affected - it ships with the upstream fix already in place. The vulnerable StringTokenizer-based parsing was replaced with proper LDAP name parsing using javax.naming.ldap.LdapName and Rdn classes in DefaultHostnameVeri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:35:45.251180+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.10-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target version 4.5.10 is not affected by CVE-2015-5262. The upstream fix (commit 1d09a8308 by olegk@apache.org) that prevents SSL handshake timeout hangs was already applied in the 4.5.10 release before TuxCare onboarding. The fix sets socket timeout before SSL connection to prevent indefinite hangs during SSL handshake, eliminating the denial-of-service vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 Target version 4.5.10 is not affected by CVE-2015-5262. The upstream fix (commit 1d09a8308 by olegk@apache.org) that prevents SSL handshake timeout hangs was already applied in the 4.5.10 release before TuxCare onboarding. The fix sets socket timeout before SSL connection to prevent indefinite hangs during SSL handshake, eliminating the denial-of-service vulnerability."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.10-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}