{
  "@id": "urn:uuid:c02b5c7a-0f1a-4b93-8a59-673abe937a89",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:12:00.050227+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:19:00.073279+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.6-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is NOT present in the target repository (version 4.5.6-tuxcare.1). The vulnerability was fixed in Apache HttpClient 4.1.1 (2011) by commit a572756592c969affd0ce87885724e74839176fb authored by Oleg Kalnichevski (olegk@apache.org). The fix adds a check for tunneled connections to prevent the Proxy-Authorization header from being leaked to origin servers. This upstream fix was alread...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 is NOT present in the target repository (version 4.5.6-tuxcare.1). The vulnerability was fixed in Apache HttpClient 4.1.1 (2011) by commit a572756592c969affd0ce87885724e74839176fb authored by Oleg Kalnichevski (olegk@apache.org). The fix adds a check for tunneled connections to prevent the Proxy-Authorization header from being leaked to origin servers. This upstream fix was alread..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:39:00.054476+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.6-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects Apache HttpComponents Client versions before 4.2.3 due to improper CN extraction from X.509 certificates using vulnerable string tokenization (indexOf \"CN=\") that could match substrings in non-CN fields. Target version 4.5.6 contains the upstream fix (commit 196ac3f328 from August 2014 by Oleg Kalnichevski) that replaced the vulnerable pattern with proper LDAP parsing usin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 affects Apache HttpComponents Client versions before 4.2.3 due to improper CN extraction from X.509 certificates using vulnerable string tokenization (indexOf \"CN=\") that could match substrings in non-CN fields. Target version 4.5.6 contains the upstream fix (commit 196ac3f328 from August 2014 by Oleg Kalnichevski) that replaced the vulnerable pattern with proper LDAP parsing usin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:12:00.050227+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.6-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 is not present in Apache HttpClient 4.5.6. The vulnerability (missing null-check for X509HostnameVerifier allowing hostname verification bypass) was fixed by Apache upstream in commit 08140864e3 on 2013-10-02, which ensures the hostname verifier is never null by setting it to DefaultHostnameVerifier when not explicitly configured. This fix shipped in the upstream Apache HttpClient...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 is not present in Apache HttpClient 4.5.6. The vulnerability (missing null-check for X509HostnameVerifier allowing hostname verification bypass) was fixed by Apache upstream in commit 08140864e3 on 2013-10-02, which ensures the hostname verifier is never null by setting it to DefaultHostnameVerifier when not explicitly configured. This fix shipped in the upstream Apache HttpClient..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:34:37.799956+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.6-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 affects Apache HttpClient before 4.3.5 due to improper CN extraction using string tokenization. The target version 4.5.6-tuxcare.1 is NOT AFFECTED because Apache upstream fixed this vulnerability in August 2014 (commit 196ac3f3) by creating DefaultHostnameVerifier.extractCN() with proper LDAP DN parsing using LdapName and Rdn classes. This fix was already present in Apache's 4.5.6...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 affects Apache HttpClient before 4.3.5 due to improper CN extraction using string tokenization. The target version 4.5.6-tuxcare.1 is NOT AFFECTED because Apache upstream fixed this vulnerability in August 2014 (commit 196ac3f3) by creating DefaultHostnameVerifier.extractCN() with proper LDAP DN parsing using LdapName and Rdn classes. This fix was already present in Apache's 4.5.6..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:23:08.929707+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.6-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 The target httpcomponents-client 4.5.6-tuxcare.1 is not affected by CVE-2015-5262. The vulnerability was fixed by the upstream Apache project in commit 1d09a8308f271d8d255681d5599811b2fff43c7f (September 2014), which added socket timeout enforcement during SSL handshake. This fix was already present in the upstream Apache HttpClient 4.5.6 release that TuxCare onboarded. The vulnerable code patt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 The target httpcomponents-client 4.5.6-tuxcare.1 is not affected by CVE-2015-5262. The vulnerability was fixed by the upstream Apache project in commit 1d09a8308f271d8d255681d5599811b2fff43c7f (September 2014), which added socket timeout enforcement during SSL handshake. This fix was already present in the upstream Apache HttpClient 4.5.6 release that TuxCare onboarded. The vulnerable code patt..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.6-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}