{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:43baf9e4-b55a-5d50-9c38-cba23a5739c6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3",
      "version": "4.2.1-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fb4dc19b-a76d-5bc6-8482-836726b90c0c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.2.1-tuxcare.3 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is not present in this target. The vulnerability (Proxy-Authorization header leaked to origin server when tunneling through authenticating proxy) was fixed by upstream Apache in commit a572756592c969affd0ce87885724e74839176fb, which is part of the Apache HttpClient 4.1.1 release. The target version 4.2.1-tuxcare.3 was onboarded by TuxCare with this upstream fix already present. Th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a7b0a7d3-3751-5647-a8c6-54f3bfa1a71e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2012-6153 is fixed in version 4.2.1-tuxcare.3 of org.apache.httpcomponents:httpclient."
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:679b4fd8-f00c-54ce-a6c2-23c40082e357",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-4366 affects version 4.2.1-tuxcare.3 of org.apache.httpcomponents:httpclient, and is fixed in 4.2.1-tuxcare.4."
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3e36df89-a809-577c-9179-f923afade171",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3577 affects version 4.2.1-tuxcare.3 of org.apache.httpcomponents:httpclient, and is fixed in 4.2.1-tuxcare.5."
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7718387d-beb4-5b35-b217-e8dce627dca6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-5262 is fixed in version 4.2.1-tuxcare.3 of org.apache.httpcomponents:httpclient."
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:06cb4370-0e19-5750-958f-80ee50b17b06",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.2.1-tuxcare.3 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.2.1-tuxcare.3"
    }
  ]
}