[Bug 58514] New: jmeter depends on obsolete commons-httpclient library

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58514

            Bug ID: 58514
           Summary: jmeter depends on obsolete commons-httpclient library
           Product: JMeter
           Version: 2.11
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Main
          Assignee: issues@jmeter.apache.org
          Reporter: apo@gambaru.de

jmeter depends on commons-httpclient. https://hc.apache.org/httpclient-3.x/

This library has reached EOL status four years ago and was replaced by Apache
httpcomponents-client:

https://hc.apache.org/httpcomponents-client-ga/index.html

commons-httpclient was affected by multiple security issues in the past but is
no longer supported by its upstream developers. This makes it difficult for
Linux distributions to provide any support for applications and libraries which
still depend on commons-httpclient.

Please consider to make the switch to httpcomponents-client

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 58514] jmeter depends on obsolete commons-httpclient library

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58514

--- Comment #3 from Markus Koschany <ap...@gambaru.de> ---
I'm a member of the Debian Java team and we maintain jmeter for Debian. I have
reported this bug because we cannot build jmeter without build-depending on
commons-httpclient. However we would like to remove commons-httpclient from
Debian because it is unmaintained and its upstream developer strongly
recommends to switch to httpcomponents-client. Since commons-httpclient was
affected by multiple security vulnerabilities in the recent past, we would like
to reduce the maintenance burden.

We would prefer that jmeter no longer requires to build-depend on
commons-httpclient.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 58514] jmeter depends on obsolete commons-httpclient library

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58514

Sebb <se...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #1 from Sebb <se...@apache.org> ---
JMeter already uses httpcomponents-client; just make sure you use the
appropriate HTTP implementation.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 58514] jmeter depends on obsolete commons-httpclient library

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=58514

--- Comment #2 from Milamber <mi...@apache.org> ---

@sebb I not sure that the issue was an incorrect choice of the HTTP request
implementation. I thinks that is to create a jmeter package for a Linux
distribution, the maintainer must add dependencies of the HC3.x because JMeter
offer the possibility to use HC3 HTTP request implementation.

For example Debian :
https://packages.debian.org/jessie/jmeter
https://packages.debian.org/jessie/libcommons-httpclient-java

One minor security issue for HC (3/4)
https://security-tracker.debian.org/tracker/source-package/commons-httpclient
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5262

-- 
You are receiving this mail because:
You are the assignee for the bug.