{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:230399a9-c063-5185-b96f-62a39057afc3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1",
      "version": "4.4.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.4.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3007734-583c-5440-9641-c5c96215bb78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.4.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is not present in httpcomponents-client 4.4.1-tuxcare.1. The vulnerability (Proxy-Authorization header leaked to origin servers during tunneled connections) was fixed by Apache upstream in commit a572756 (February 2011) and shipped in the upstream release that TuxCare onboarded. The fix is present in both the deprecated RequestProxyAuthentication class (lines 75-77) and the modern...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:71079058-8330-563c-91d1-24507f3fdc8e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6153 does not affect version 4.4.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects httpcomponents-client versions that use vulnerable manual string parsing for CN extraction from X.509 certificates. Version 4.4.1 is NOT affected because the vulnerable code pattern was replaced with proper LDAP parsing (LdapName + JNDI) in an upstream architectural refactoring by Apache developer Oleg Kalnichevski (commit 196ac3f3, Aug 2014). The vulnerable `indexOf(\"CN=\"...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:773de503-02d6-5b23-af9a-e7878739f728",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4366 does not affect version 4.4.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 is not present in Apache HttpClient 4.4.1. The vulnerability affects versions 4.3.x before 4.3.1, where HttpClientBuilder.java failed to ensure X509HostnameVerifier was not null, potentially allowing hostname verification bypass. The target version 4.4.1 contains the upstream fix (commit 08140864e by Oleg Kalnichevski) that was introduced in version 4.3.1. The fix ensures that if ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c0facf9c-524e-5c76-8587-82df614b043e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3577 does not affect version 4.4.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target version 4.4.1-tuxcare.1 is NOT AFFECTED by CVE-2014-3577. The vulnerable StringTokenizer-based CN extraction code was replaced with proper LDAP DN parsing (using LdapName/Rdn) in upstream commit 0852f1b4d (July 2014) by Apache developer olegk@apache.org. This fix was included in the upstream 4.4.1 release (March 2015) that TuxCare onboarded. The target code uses DefaultHostnameVerifier.e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8d72d766-7d82-529a-aade-d58a4641e10f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5262 does not affect version 4.4.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 is not present in Apache HttpComponents Client 4.4.1-tuxcare.1. The vulnerability (missing socket timeout during SSL handshake) was fixed in upstream Apache commits 1d09a8308 (SSLConnectionSocketFactory) and 09027e728 (deprecated SSLSocketFactory), both authored by olegk@apache.org and already present in the upstream 4.4.1 release before TuxCare onboarded it. The fix applies socke...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e4ae924c-f7a6-5363-828b-50705a0f8196",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.4.1-tuxcare.1 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4.1-tuxcare.1"
    }
  ]
}