{
  "@id": "urn:uuid:b804a164-03e4-4313-8431-7655e0aa63a2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:14:00.487878+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:21:23.688226+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.8-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpComponents Client 4.5.8. The vulnerability involved Proxy-Authorization headers being sent to origin servers when using tunneled HTTPS connections through authenticating proxies. The fix (checking route.isTunnelled() before adding proxy auth headers) was introduced in upstream commit a572756592c969affd0ce87885724e74839176fb by Oleg Kalnichevski and shi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpComponents Client 4.5.8. The vulnerability involved Proxy-Authorization headers being sent to origin servers when using tunneled HTTPS connections through authenticating proxies. The fix (checking route.isTunnelled() before adding proxy auth headers) was introduced in upstream commit a572756592c969affd0ce87885724e74839176fb by Oleg Kalnichevski and shi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:02.973774+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.8-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects Apache HttpClient before version 4.2.3. The target version 4.5.8 (released March 2019) already contains the upstream fix from November 2012 (HTTPCLIENT-1255). The vulnerable CN extraction code using indexOf(\"CN=\") was replaced with a secure LdapName-based implementation in DefaultHostnameVerifier. The fix was shipped in the upstream release, not backported by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 affects Apache HttpClient before version 4.2.3. The target version 4.5.8 (released March 2019) already contains the upstream fix from November 2012 (HTTPCLIENT-1255). The vulnerable CN extraction code using indexOf(\"CN=\") was replaced with a secure LdapName-based implementation in DefaultHostnameVerifier. The fix was shipped in the upstream release, not backported by TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:14:00.487878+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.8-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder did not ensure X509HostnameVerifier was non-null, potentially allowing hostname verification bypass. The target version 4.5.8 contains the upstream fix (commit 08140864e3 from Oct 2, 2013 by Apache committer Oleg Kalnichevski) which ensures a DefaultHostnameVerifier is initialized when none is explicitly set. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder did not ensure X509HostnameVerifier was non-null, potentially allowing hostname verification bypass. The target version 4.5.8 contains the upstream fix (commit 08140864e3 from Oct 2, 2013 by Apache committer Oleg Kalnichevski) which ensures a DefaultHostnameVerifier is initialized when none is explicitly set. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:51:30.244249+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.8-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target version 4.5.8 is NOT AFFECTED by CVE-2014-3577. The vulnerable StringTokenizer-based CN extraction code is not present. The fix (proper LDAP DN parsing using LdapName/Rdn) was introduced by upstream Apache commit 196ac3f3 (author: olegk@apache.org) and shipped in the upstream 4.5.8 release before TuxCare onboarded it. All hostname verification code paths use the fixed implementation in D...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 Target version 4.5.8 is NOT AFFECTED by CVE-2014-3577. The vulnerable StringTokenizer-based CN extraction code is not present. The fix (proper LDAP DN parsing using LdapName/Rdn) was introduced by upstream Apache commit 196ac3f3 (author: olegk@apache.org) and shipped in the upstream 4.5.8 release before TuxCare onboarded it. All hostname verification code paths use the fixed implementation in D..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:29:49.421389+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.8-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 affects Apache HttpComponents HttpClient before 4.3.6. The target version 4.5.8 already contains the upstream fix (commit 1d09a8308f271d8d255681d5599811b2fff43c7f by olegk@apache.org) that prevents SSL handshake timeouts from being ignored. The fix was shipped in the upstream release before TuxCare onboarded version 4.5.8, making this an upstream vendor fix rather than a TuxCare b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5262 affects Apache HttpComponents HttpClient before 4.3.6. The target version 4.5.8 already contains the upstream fix (commit 1d09a8308f271d8d255681d5599811b2fff43c7f by olegk@apache.org) that prevents SSL handshake timeouts from being ignored. The fix was shipped in the upstream release before TuxCare onboarded version 4.5.8, making this an upstream vendor fix rather than a TuxCare b..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.8-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}