{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a76bfb5e-b19f-599e-af99-9d67fa198557",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1",
      "version": "4.5.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.5.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5ea6759c-fca9-5eb7-9b09-52db6ef4e156",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.5.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is NOT present in httpcomponents-client 4.5.5. The vulnerability (Proxy-Authorization header leaked to origin server when using tunneled connections through authenticating proxy) was fixed in upstream commit a572756592c969affd0ce87885724e74839176fb by Apache developer Oleg Kalnichevski in February 2011 for version 4.1.1. This fix was already present in the upstream 4.5.5 release w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c6a5e84e-8acb-5891-9b26-db6947328556",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6153 does not affect version 4.5.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target version 4.5.5 is NOT affected by CVE-2012-6153. The vulnerable CN extraction logic using indexOf(\"CN=\") does not exist in this version. The hostname verification code was completely redesigned by upstream Apache in commit 196ac3f32 (August 2014) to use javax.naming.ldap.LdapName for proper Distinguished Name parsing. This fix was already present in the upstream Apache HttpClient 4.5.5 re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c250f867-d6dd-527a-9032-4feeb068ed57",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4366 does not affect version 4.5.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 was fixed by Apache upstream in commit 08140864e (October 2, 2013), 13 years before TuxCare began maintaining this repository. The target version 4.5.5-tuxcare.1 includes this fix as part of the upstream release it was built from. The vulnerable pattern\u2014a missing null check for X509HostnameVerifier that could allow hostname verification bypass\u2014is not present in the target code. Th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2cb20f9f-cfb5-596c-83c5-cfe246994ae4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3577 does not affect version 4.5.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 is NOT present in httpcomponents-client 4.5.5-tuxcare.1. The vulnerable StringTokenizer-based CN extraction pattern has been replaced with proper LdapName/Rdn parsing. The fix was introduced by upstream Apache developer Oleg Kalnichevski in commit 196ac3f328 on August 18, 2014 (shortly after CVE disclosure) and shipped in the upstream 4.5.5 release (January 2018) that TuxCare onbo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f8b5a751-5f15-534f-8429-49de79c14cfa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5262 does not affect version 4.5.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 The target httpcomponents-client 4.5.5 is not affected by CVE-2015-5262. The vulnerability (missing socket timeout during SSL handshake causing DoS) was fixed by Apache upstream in commit 1d09a8308 (2014-09-22), which was already present in the 4.5.5 release. Both SSLConnectionSocketFactory (lines 333-335) and deprecated SSLSocketFactory (lines 411-413) set socket timeout before connection atte...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:767415fe-c740-58dd-8ae2-b8e9bb91cb6c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.5.5-tuxcare.1 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.5-tuxcare.1"
    }
  ]
}