{
  "@id": "urn:uuid:6784886a-0945-49ff-a256-496e57b8c698",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:13:00.083381+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:20:04.987218+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.2-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 affects Apache HttpClient 4.x before 4.1.1. The vulnerability involved the Proxy-Authorization header being incorrectly sent to origin servers when using tunneled proxy connections. The target repository (version 4.5.2) contains the upstream fix committed by Oleg Kalnichevski (olegk@apache.org) on 2011-02-25 in commit a572756592c969affd0ce87885724e74839176fb. This fix was already ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 affects Apache HttpClient 4.x before 4.1.1. The vulnerability involved the Proxy-Authorization header being incorrectly sent to origin servers when using tunneled proxy connections. The target repository (version 4.5.2) contains the upstream fix committed by Oleg Kalnichevski (olegk@apache.org) on 2011-02-25 in commit a572756592c969affd0ce87885724e74839176fb. This fix was already ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:38:00.058578+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.2-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects Apache HttpComponents Client versions before 4.2.3. The vulnerability is in the CN extraction from X.509 certificates: the code used indexOf(\"CN=\") which would match \"CN=\" anywhere in a Distinguished Name token, allowing attackers to place \"CN=attacker.com\" in non-CN fields (e.g., \"OU=CN=attacker.com\") and bypass hostname verification. The target version 4.5.2 is not affec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 affects Apache HttpComponents Client versions before 4.2.3. The vulnerability is in the CN extraction from X.509 certificates: the code used indexOf(\"CN=\") which would match \"CN=\" anywhere in a Distinguished Name token, allowing attackers to place \"CN=attacker.com\" in non-CN fields (e.g., \"OU=CN=attacker.com\") and bypass hostname verification. The target version 4.5.2 is not affec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:13:00.083381+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.2-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1 due to HttpClientBuilder not ensuring X509HostnameVerifier is not null, which could allow attackers to bypass hostname verification. The target version 4.5.2-tuxcare.1 is NOT AFFECTED because the upstream fix was applied in version 4.3.1 (October 2013) and is present in the target. The fix adds a null check at lines 953-956 of HttpClien...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1 due to HttpClientBuilder not ensuring X509HostnameVerifier is not null, which could allow attackers to bypass hostname verification. The target version 4.5.2-tuxcare.1 is NOT AFFECTED because the upstream fix was applied in version 4.3.1 (October 2013) and is present in the target. The fix adds a null check at lines 953-956 of HttpClien..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:41:00.121654+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.2-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 is NOT present in Apache HttpComponents Client 4.5.2-tuxcare.1. The vulnerable code pattern (string tokenization CN extraction) was replaced with proper LDAP DN parsing (LdapName/Rdn) in upstream commit 0852f1b4d (July 2014), which was already included in the Apache 4.5.2 release that TuxCare onboarded. The target uses DefaultHostnameVerifier.extractCN() which correctly extracts o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 is NOT present in Apache HttpComponents Client 4.5.2-tuxcare.1. The vulnerable code pattern (string tokenization CN extraction) was replaced with proper LDAP DN parsing (LdapName/Rdn) in upstream commit 0852f1b4d (July 2014), which was already included in the Apache 4.5.2 release that TuxCare onboarded. The target uses DefaultHostnameVerifier.extractCN() which correctly extracts o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:33:36.078925+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.2-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 is NOT present in httpcomponents-client 4.5.2. The vulnerability affects versions before 4.3.6 where SSL handshake operations ignore socket timeout configuration, allowing indefinite hangs. Both upstream fix commits (1d09a8308 and 09027e728, authored by olegk@apache.org in 2014) were included in the Apache HttpClient 4.5.2 release (February 2016) that TuxCare onboarded. The fixes ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5262 is NOT present in httpcomponents-client 4.5.2. The vulnerability affects versions before 4.3.6 where SSL handshake operations ignore socket timeout configuration, allowing indefinite hangs. Both upstream fix commits (1d09a8308 and 09027e728, authored by olegk@apache.org in 2014) were included in the Apache HttpClient 4.5.2 release (February 2016) that TuxCare onboarded. The fixes ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.2-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}