{
  "@id": "urn:uuid:4043c00a-1282-4622-8183-96b250231904",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:09:47.386179+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:19:19.245748+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.9-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 affects Apache HttpClient before version 4.1.1. The target is version 4.5.9-tuxcare.1, which already contains the upstream fix. The vulnerability (sending Proxy-Authorization headers to origin servers during tunnelled HTTPS connections) is not present. The fix commit a572756592c969affd0ce87885724e74839176fb by upstream Apache developer Oleg Kalnichevski was included in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 affects Apache HttpClient before version 4.1.1. The target is version 4.5.9-tuxcare.1, which already contains the upstream fix. The vulnerability (sending Proxy-Authorization headers to origin servers during tunnelled HTTPS connections) is not present. The fix commit a572756592c969affd0ce87885724e74839176fb by upstream Apache developer Oleg Kalnichevski was included in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:38:29.326406+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.9-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 is not present in httpcomponents-client 4.5.9. The vulnerability (improper CN extraction from X.509 certificates using indexOf(\"CN=\") allowing spoofing via non-CN fields like \"OU=CN=attacker.com\") was fixed by Apache upstream in commit 6e14fc146a66e0f3eb362f45f95d1a58ee18886a (November 2012) and further improved by a complete hostname verification redesign in August 2014. Version ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 is not present in httpcomponents-client 4.5.9. The vulnerability (improper CN extraction from X.509 certificates using indexOf(\"CN=\") allowing spoofing via non-CN fields like \"OU=CN=attacker.com\") was fixed by Apache upstream in commit 6e14fc146a66e0f3eb362f45f95d1a58ee18886a (November 2012) and further improved by a complete hostname verification redesign in August 2014. Version ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:09:47.386179+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.9-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder did not ensure X509HostnameVerifier is not null, potentially allowing hostname verification bypass. The target version 4.5.9 is not affected because the upstream fix (commit 08140864e by Oleg Kalnichevski, Oct 2 2013) was already present in the upstream 4.5.9 release before TuxCare onboarding. The defense code a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder did not ensure X509HostnameVerifier is not null, potentially allowing hostname verification bypass. The target version 4.5.9 is not affected because the upstream fix (commit 08140864e by Oleg Kalnichevski, Oct 2 2013) was already present in the upstream 4.5.9 release before TuxCare onboarding. The defense code a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:37:11.242011+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.9-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 affects Apache HttpComponents HttpClient before 4.3.5. Target version 4.5.9 is not vulnerable. The vulnerable StringTokenizer-based CN extraction code is absent; the fix using proper LDAP DN parsing (LdapName/Rdn) was introduced by upstream Apache in August 2014 (commit 196ac3f32) and was already present in the upstream 4.5.9 release that TuxCare onboarded. No TuxCare backport was...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 affects Apache HttpComponents HttpClient before 4.3.5. Target version 4.5.9 is not vulnerable. The vulnerable StringTokenizer-based CN extraction code is absent; the fix using proper LDAP DN parsing (LdapName/Rdn) was introduced by upstream Apache in August 2014 (commit 196ac3f32) and was already present in the upstream 4.5.9 release that TuxCare onboarded. No TuxCare backport was..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:28:42.058910+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.9-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 is NOT present in Apache HttpComponents HttpClient 4.5.9-tuxcare.1. The vulnerability (socket timeout ignored during SSL handshake, causing indefinite hangs) was fixed in upstream version 4.3.6 (September 2014). The target version 4.5.9 already contains the upstream fix, which applies socket timeout via setSoTimeout() before socket connection establishment. The fix commit (1d09a83...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5262 is NOT present in Apache HttpComponents HttpClient 4.5.9-tuxcare.1. The vulnerability (socket timeout ignored during SSL handshake, causing indefinite hangs) was fixed in upstream version 4.3.6 (September 2014). The target version 4.5.9 already contains the upstream fix, which applies socket timeout via setSoTimeout() before socket connection establishment. The fix commit (1d09a83..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.9-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}