{
  "@id": "urn:uuid:f4c849ec-ac85-414c-8c85-f5c8c3c2d5da",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:13:00.083381+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:22:00.100031+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 affects Apache HttpClient 4.x before 4.1.1, where the Proxy-Authorization header is incorrectly sent to origin servers when using an authenticating proxy. The target repository at version 4.5-tuxcare.1 is NOT AFFECTED because the upstream vendor (Apache) already fixed this vulnerability in the 4.5 release. The fix prevents proxy credentials from being sent to origin servers by che...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 affects Apache HttpClient 4.x before 4.1.1, where the Proxy-Authorization header is incorrectly sent to origin servers when using an authenticating proxy. The target repository at version 4.5-tuxcare.1 is NOT AFFECTED because the upstream vendor (Apache) already fixed this vulnerability in the 4.5 release. The fix prevents proxy credentials from being sent to origin servers by che..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:39:54.812453+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 concerns improper CN extraction from X.509 certificates using indexOf(\"CN=\"), which would match non-CN fields like \"OU=CN=evil.com\". The target (httpcomponents-client 4.5) is NOT AFFECTED because the vulnerable code pattern is completely absent. Version 4.5 uses DefaultHostnameVerifier.extractCN() with javax.naming.ldap.LdapName parser, which properly identifies RDN types and cann...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 concerns improper CN extraction from X.509 certificates using indexOf(\"CN=\"), which would match non-CN fields like \"OU=CN=evil.com\". The target (httpcomponents-client 4.5) is NOT AFFECTED because the vulnerable code pattern is completely absent. Version 4.5 uses DefaultHostnameVerifier.extractCN() with javax.naming.ldap.LdapName parser, which properly identifies RDN types and cann..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:13:00.083381+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1 due to missing null check for X509HostnameVerifier, potentially allowing hostname verification bypass. The target version 4.5 contains the upstream fix (commit 08140864e by olegk@apache.org, Oct 2013) that ensures the hostname verifier is never null by setting a DefaultHostnameVerifier when none is provided. This fix was already present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1 due to missing null check for X509HostnameVerifier, potentially allowing hostname verification bypass. The target version 4.5 contains the upstream fix (commit 08140864e by olegk@apache.org, Oct 2013) that ensures the hostname verifier is never null by setting a DefaultHostnameVerifier when none is provided. This fix was already present..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:48:37.816652+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 affects Apache HttpClient's hostname verification when extracting CN from X.509 certificates. The vulnerability allows MITM attacks by accepting \"CN=\" substrings in non-CN fields (e.g., O=foo,CN=www.apache.org). The target version 4.5 is NOT AFFECTED because the upstream fix was already present in the release. The fix (commit 196ac3f32 by olegk@apache.org, Aug 18 2014) replaced vu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 affects Apache HttpClient's hostname verification when extracting CN from X.509 certificates. The vulnerability allows MITM attacks by accepting \"CN=\" substrings in non-CN fields (e.g., O=foo,CN=www.apache.org). The target version 4.5 is NOT AFFECTED because the upstream fix was already present in the release. The fix (commit 196ac3f32 by olegk@apache.org, Aug 18 2014) replaced vu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:29:49.421389+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 affects Apache HttpComponents Client versions before 4.3.6 due to SSLConnectionSocketFactory ignoring socket timeout during SSL handshake. The target version 4.5-tuxcare.1 already contains the upstream fix (commit 1d09a830) that sets socket timeout before SSL handshake operations. The fix was authored by Apache committer olegk@apache.org and shipped in the upstream 4.5 release, wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5262 affects Apache HttpComponents Client versions before 4.3.6 due to SSLConnectionSocketFactory ignoring socket timeout during SSL handshake. The target version 4.5-tuxcare.1 already contains the upstream fix (commit 1d09a830) that sets socket timeout before SSL handshake operations. The fix was authored by Apache committer olegk@apache.org and shipped in the upstream 4.5 release, wh..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}