{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2bb7992c-9d34-5fff-a02a-404ba169937b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2",
      "version": "4.1.2-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.1.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5cc12a6b-7415-522f-9fdb-e046b5053646",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.1.2-tuxcare.2 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is not present in this target. The vulnerability (Proxy-Authorization header leaking to origin servers when using tunneled connections) was fixed in upstream Apache HttpClient 4.1.1 by commit a572756592c969affd0ce87885724e74839176fb authored by Oleg Kalnichevski. The target is version 4.1.2, which TuxCare onboarded with this fix already included. The fix adds a tunnel check (lines...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:56497a2c-ee63-5da6-a504-15564375a320",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2012-6153 is fixed in version 4.1.2-tuxcare.2 of org.apache.httpcomponents:httpclient."
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b418192c-fc6c-558b-bc91-ea9cc5b7c7e7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4366 does not affect version 4.1.2-tuxcare.2 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 specifically affects HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1. The target version 4.1.2 predates the 4.3.x series and does not contain the HttpClientBuilder class, which was introduced in version 4.3.0. The vulnerability is specific to HttpClientBuilder's handling of X509HostnameVerifier, and this component is entirely absent from version 4.1.2. The CVE versi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:db73e373-ecfd-5a32-af9b-d96889231f59",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2014-3577 is fixed in version 4.1.2-tuxcare.2 of org.apache.httpcomponents:httpclient."
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a3afbcb0-50d1-5591-baea-58bfcc8a0d1c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-5262 is fixed in version 4.1.2-tuxcare.2 of org.apache.httpcomponents:httpclient."
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fa1b12b8-8551-51ed-8270-6066fa49d70f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.1.2-tuxcare.2 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.1.2-tuxcare.2"
    }
  ]
}