jmeter depends on commons-httpclient. https://hc.apache.org/httpclient-3.x/ This library has reached EOL status four years ago and was replaced by Apache httpcomponents-client: https://hc.apache.org/httpcomponents-client-ga/index.html commons-httpclient was affected by multiple security issues in the past but is no longer supported by its upstream developers. This makes it difficult for Linux distributions to provide any support for applications and libraries which still depend on commons-httpclient. Please consider to make the switch to httpcomponents-client
JMeter already uses httpcomponents-client; just make sure you use the appropriate HTTP implementation.
@sebb I not sure that the issue was an incorrect choice of the HTTP request implementation. I thinks that is to create a jmeter package for a Linux distribution, the maintainer must add dependencies of the HC3.x because JMeter offer the possibility to use HC3 HTTP request implementation. For example Debian : https://packages.debian.org/jessie/jmeter https://packages.debian.org/jessie/libcommons-httpclient-java One minor security issue for HC (3/4) https://security-tracker.debian.org/tracker/source-package/commons-httpclient https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5262
I'm a member of the Debian Java team and we maintain jmeter for Debian. I have reported this bug because we cannot build jmeter without build-depending on commons-httpclient. However we would like to remove commons-httpclient from Debian because it is unmaintained and its upstream developer strongly recommends to switch to httpcomponents-client. Since commons-httpclient was affected by multiple security vulnerabilities in the recent past, we would like to reduce the maintenance burden. We would prefer that jmeter no longer requires to build-depend on commons-httpclient.
This issue has been migrated to GitHub: https://github.com/apache/jmeter/issues/3682