{
  "@id": "urn:uuid:024a1ad5-0318-43fa-9abf-a4807a41d705",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:08:58.117797+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:19:41.730784+00:00",
      "status_notes": "Vulnerability CVE-2011-1498 does not affect version 4.5.12-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 The target Apache HttpComponents Client 4.5.12-tuxcare.1 is NOT AFFECTED by CVE-2011-1498. The vulnerability (Proxy-Authorization header incorrectly sent to origin servers through tunneled connections) was fixed in the upstream Apache release before TuxCare onboarded version 4.5.12. The fix is present in both the deprecated (RequestProxyAuthentication.java) and modern (MainClientExec.java) code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-1498"
      },
      "impact_statement": "not_affected \u2014 The target Apache HttpComponents Client 4.5.12-tuxcare.1 is NOT AFFECTED by CVE-2011-1498. The vulnerability (Proxy-Authorization header incorrectly sent to origin servers through tunneled connections) was fixed in the upstream Apache release before TuxCare onboarded version 4.5.12. The fix is present in both the deprecated (RequestProxyAuthentication.java) and modern (MainClientExec.java) code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:41:29.032373+00:00",
      "status_notes": "Vulnerability CVE-2012-6153 does not affect version 4.5.12-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects Apache HttpClient before 4.2.3 due to improper CN extraction using indexOf(\"CN=\") which could match \"CN=\" anywhere in a DN component (e.g., \"OU=CN=attacker.com\"). The target version 4.5.12 is NOT affected because the vulnerable code pattern was completely replaced in upstream version 4.4 (2014) with DefaultHostnameVerifier, which uses proper LDAP/X500 parsing (LdapName, Rd...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-6153"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-6153 affects Apache HttpClient before 4.2.3 due to improper CN extraction using indexOf(\"CN=\") which could match \"CN=\" anywhere in a DN component (e.g., \"OU=CN=attacker.com\"). The target version 4.5.12 is NOT affected because the vulnerable code pattern was completely replaced in upstream version 4.4 (2014) with DefaultHostnameVerifier, which uses proper LDAP/X500 parsing (LdapName, Rd..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:08:58.117797+00:00",
      "status_notes": "Vulnerability CVE-2013-4366 does not affect version 4.5.12-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder.java doesn't ensure X509HostnameVerifier is not null, allowing hostname verification bypass and MITM attacks. The target version 4.5.12 contains an upstream fix (commit 08140864e by olegk@apache.org, dated 2013-10-02) that ensures a default DefaultHostnameVerifier is always created when the field is null. This f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4366"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder.java doesn't ensure X509HostnameVerifier is not null, allowing hostname verification bypass and MITM attacks. The target version 4.5.12 contains an upstream fix (commit 08140864e by olegk@apache.org, dated 2013-10-02) that ensures a default DefaultHostnameVerifier is always created when the field is null. This f..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:39:25.308989+00:00",
      "status_notes": "Vulnerability CVE-2014-3577 does not affect version 4.5.12-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2014-3577 affects Apache HttpClient before 4.3.5. The target version 4.5.12 contains the upstream fix from July 2014 (commit 0852f1b4d by olegk@apache.org) which replaced vulnerable StringTokenizer-based DN parsing with proper JNDI LdapName parsing. All CN extraction code paths now use DefaultHostnameVerifier.extractCN() which correctly interprets X.500 DN structure and only extracts values...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3577"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3577 affects Apache HttpClient before 4.3.5. The target version 4.5.12 contains the upstream fix from July 2014 (commit 0852f1b4d by olegk@apache.org) which replaced vulnerable StringTokenizer-based DN parsing with proper JNDI LdapName parsing. All CN extraction code paths now use DefaultHostnameVerifier.extractCN() which correctly interprets X.500 DN structure and only extracts values..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:26:24.626363+00:00",
      "status_notes": "Vulnerability CVE-2015-5262 does not affect version 4.5.12-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2015-5262 affects Apache HttpComponents HttpClient before version 4.3.6. The target repository is version 4.5.12, which already contains the upstream fix. The vulnerability pattern (missing socket timeout during SSL handshake) is not present because the fix was shipped in the upstream release before TuxCare onboarded this version. The fix was authored by Apache upstream developer Oleg Kalni...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5262"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5262 affects Apache HttpComponents HttpClient before version 4.3.6. The target repository is version 4.5.12, which already contains the upstream fix. The vulnerability pattern (missing socket timeout during SSL handshake) is not present because the fix was shipped in the upstream release before TuxCare onboarded this version. The fix was authored by Apache upstream developer Oleg Kalni..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13956 is fixed in version 4.5.12-tuxcare.1 of org.apache.httpcomponents:httpclient.",
      "vulnerability": {
        "name": "CVE-2020-13956"
      }
    }
  ]
}