{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d16e4600-615f-524d-ae3c-a0ba079eb65a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1",
      "version": "4.5.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.5.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9991845b-f844-597c-8345-da806f340d34",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.5.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is not present in httpcomponents-client 4.5.4. The vulnerability, which caused Proxy-Authorization headers to be sent to origin servers when tunneling through an authenticating proxy, was fixed in upstream Apache HttpClient 4.1.1. The fix (commit a572756592c969affd0ce87885724e74839176fb by olegk@apache.org) was already present in the upstream release that TuxCare onboarded for ver...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8d4397f2-0c27-52e7-a6b7-c03d3201523d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6153 does not affect version 4.5.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects Apache HttpComponents Client before version 4.2.3 due to improper hostname verification in AbstractVerifier.java. The target version 4.5.4 is not affected because the upstream Apache project fixed both vulnerability components (wildcard matching bug and CN extraction bug) in November 2012, and these fixes shipped in the upstream 4.5.4 release that TuxCare onboarded. The vu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dacee604-d5e7-58c6-8dfb-8b05659562c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4366 does not affect version 4.5.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder.java does not ensure X509HostnameVerifier is not null. The target repository is at version 4.5.4-tuxcare.1, which already contains the upstream fix. The vulnerable pattern (missing null check on hostnameVerifier) is not present in the target code. At httpclient/src/main/java/org/apache/http/impl/client/HttpClien...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81a97e08-25ab-5a5b-81f7-d6187bf52255",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3577 does not affect version 4.5.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 is NOT present in Apache HttpComponents Client 4.5.4. The vulnerability affected versions before 4.3.5 due to improper CN extraction using StringTokenizer. The target version 4.5.4 uses proper LDAP DN parsing via DefaultHostnameVerifier.extractCN() with LdapName/Rdn classes. The fix commit (0852f1b4d \"Improved cert subject parsing\" by olegk@apache.org) was already in the upstream ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:66dc21c0-4e93-5afd-a2d8-a0e0db9e8cc6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5262 does not affect version 4.5.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 is NOT present in httpcomponents-client 4.5.4. The vulnerability (SSL handshake ignoring socket timeout configuration) was fixed in upstream Apache release 4.3.6, and version 4.5.4 already contains the fix. Both SSLConnectionSocketFactory and the deprecated SSLSocketFactory properly set socket timeouts before SSL handshakes. The fix was authored by Apache (olegk@apache.org) and sh...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c6db5e4a-7316-5603-b85a-35063db2bba3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.5.4-tuxcare.1 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.4-tuxcare.1"
    }
  ]
}