{
  "@id": "urn:uuid:4440dbd7-4b91-4f65-94b2-a0dd00a57a88",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:14:00.487878+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:22:33.577901+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpComponents Client 4.5.1-tuxcare.1. The vulnerability, which caused the Proxy-Authorization header to be sent to origin servers when using an authenticating proxy with tunneled connections, was fixed in upstream commit a572756592c969affd0ce87885724e74839176fb (HTTPCLIENT-1061) by Apache developer Oleg Kalnichevski. This fix was already included in the u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-1498 is NOT present in Apache HttpComponents Client 4.5.1-tuxcare.1. The vulnerability, which caused the Proxy-Authorization header to be sent to origin servers when using an authenticating proxy with tunneled connections, was fixed in upstream commit a572756592c969affd0ce87885724e74839176fb (HTTPCLIENT-1061) by Apache developer Oleg Kalnichevski. This fix was already included in the u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:39:00.054476+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 is NOT present in httpcomponents-client 4.5.1. The vulnerable string-based CN extraction pattern that allowed \"CN=\" to match in non-CN fields (e.g., \"OU=CN=attacker.com\") has been completely replaced with a proper LDAP-based parser (LdapName/Rdn APIs) in commit 196ac3f32 (August 2014) by upstream author olegk@apache.org. This architectural redesign was already present in the upstr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 is NOT present in httpcomponents-client 4.5.1. The vulnerable string-based CN extraction pattern that allowed \"CN=\" to match in non-CN fields (e.g., \"OU=CN=attacker.com\") has been completely replaced with a proper LDAP-based parser (LdapName/Rdn APIs) in commit 196ac3f32 (August 2014) by upstream author olegk@apache.org. This architectural redesign was already present in the upstr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:14:00.487878+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1 where X509HostnameVerifier could be null, allowing hostname verification bypass. The target version 4.5.1 includes the upstream fix (commit abe50fafe from September 2014) that ensures a DefaultHostnameVerifier is created when null. This fix was already present in the upstream release 4.5.1 when TuxCare onboarded it, making the target no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1 where X509HostnameVerifier could be null, allowing hostname verification bypass. The target version 4.5.1 includes the upstream fix (commit abe50fafe from September 2014) that ensures a DefaultHostnameVerifier is created when null. This fix was already present in the upstream release 4.5.1 when TuxCare onboarded it, making the target no..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:49:13.562594+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 is NOT present in httpcomponents-client 4.5.1. The vulnerable string tokenization pattern for CN extraction was replaced with proper LDAP DN parsing using LdapName/Rdn in DefaultHostnameVerifier. This fix was introduced by upstream Apache (olegk@apache.org) on 2014-08-18 in commit 196ac3f328, which predates the TuxCare onboarding of version 4.5.1. The vulnerable code pattern is ab...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 is NOT present in httpcomponents-client 4.5.1. The vulnerable string tokenization pattern for CN extraction was replaced with proper LDAP DN parsing using LdapName/Rdn in DefaultHostnameVerifier. This fix was introduced by upstream Apache (olegk@apache.org) on 2014-08-18 in commit 196ac3f328, which predates the TuxCare onboarding of version 4.5.1. The vulnerable code pattern is ab..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:29:49.421389+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.1-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 is NOT present in httpcomponents-client 4.5.1. The vulnerability affected versions before 4.3.6 where SSL socket timeout was ignored during handshake, causing potential DoS through indefinite connection hangs. The upstream fix (commit 1d09a8308 by olegk@apache.org) was already included in the 4.5.1 release that TuxCare onboarded. Both SSLConnectionSocketFactory.java and the deprec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5262 is NOT present in httpcomponents-client 4.5.1. The vulnerability affected versions before 4.3.6 where SSL socket timeout was ignored during handshake, causing potential DoS through indefinite connection hangs. The upstream fix (commit 1d09a8308 by olegk@apache.org) was already included in the 4.5.1 release that TuxCare onboarded. Both SSLConnectionSocketFactory.java and the deprec..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.1-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}