jmeter depends on obsolete commons-httpclient library

[asfimport]

Markus Koschany (Bug 58514):
jmeter depends on commons-httpclient. https://hc.apache.org/httpclient-3.x/

This library has reached EOL status four years ago and was replaced by Apache httpcomponents-client:

https://hc.apache.org/httpcomponents-client-ga/index.html

commons-httpclient was affected by multiple security issues in the past but is no longer supported by its upstream developers. This makes it difficult for Linux distributions to provide any support for applications and libraries which still depend on commons-httpclient.

Please consider to make the switch to httpcomponents-client

Severity: normal
OS: Linux

[asfimport]

Sebb (migrated from Bugzilla):
JMeter already uses httpcomponents-client; just make sure you use the appropriate HTTP implementation.

[asfimport]

@milamberspace (migrated from Bugzilla):

@sebb I not sure that the issue was an incorrect choice of the HTTP request implementation. I thinks that is to create a jmeter package for a Linux distribution, the maintainer must add dependencies of the HC3.x because JMeter offer the possibility to use HC3 HTTP request implementation.

For example Debian :
https://packages.debian.org/jessie/jmeter
https://packages.debian.org/jessie/libcommons-httpclient-java

One minor security issue for HC (3/4)
https://security-tracker.debian.org/tracker/source-package/commons-httpclient
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5262

[asfimport]

Markus Koschany (migrated from Bugzilla):
I'm a member of the Debian Java team and we maintain jmeter for Debian. I have reported this bug because we cannot build jmeter without build-depending on commons-httpclient. However we would like to remove commons-httpclient from Debian because it is unmaintained and its upstream developer strongly recommends to switch to httpcomponents-client. Since commons-httpclient was affected by multiple security vulnerabilities in the recent past, we would like to reduce the maintenance burden.

We would prefer that jmeter no longer requires to build-depend on commons-httpclient.