Vulnerability · Published Dec 2, 2020 · Assigned by apache
CVE-2020-13956
Medium 5.3
In plain English
A medium-severity improper input validation in Apache HttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.0% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)9.0%top 4.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aopalliance | 1.0-17.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | aopalliance | 1.0-20.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | apache-commons-cli | 1.4-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | apache-commons-cli | 1.4-4.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | apache-commons-codec | 1.13-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | apache-commons-codec | 1.11-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | apache-commons-io | 1:2.6-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | apache-commons-io | 1:2.6-6.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | apache-commons-lang3 | 3.9-4.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | apache-commons-lang3 | 3.7-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | apache-commons-logging | 1.2-13.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | atinject | 1-28.20100611svn86.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | atinject | 1-31.20100611svn86.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | cdi-api | 2.0.1-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | cdi-api | 1.2-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | geronimo-annotation | 1.0-26.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | geronimo-annotation | 1.0-23.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | glassfish-el-api | 3.0.1-0.7.b08.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | google-guice | 4.2.2-4.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | google-guice | 4.1-11.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | guava | 28.1-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | guava20 | 20.0-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | hawtjni-runtime | 1.16-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | httpcomponents-client | 4.5.5-5.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | httpcomponents-client | 4.5.10-4.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | httpcomponents-core | 4.4.12-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | httpcomponents-core | 4.4.10-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | jansi | 1.17.1-1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | jansi | 1.17.1-1.module_el8.0.0+6044+f3cbc35d | ALSA-2022:1861 |
| AlmaLinux:8 | jansi | 1.17.1-1.module_el8.4.0+2250+516cbbff | ALSA-2022:1861 |
| AlmaLinux:8 | jansi | 1.18-4.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | jansi-native | 1.7-7.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | jboss-interceptors-1.2-api | 1.0.0-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | jcl-over-slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | jcl-over-slf4j | 1.7.28-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | jsoup | 1.12.1-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | jsoup | 1.11.3-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | jsr-305 | 0-0.25.20130910svn.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-lib | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-lib | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-openjdk11 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-openjdk17 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-openjdk8 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-resolver | 1.4.1-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-resolver-api | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-resolver-connector-basic | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-resolver-impl | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-resolver-spi | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-resolver-transport-wagon | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-resolver-util | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-shared-utils | 3.2.1-0.4.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-shared-utils | 3.2.1-0.1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-wagon | 3.3.4-2.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | maven-wagon-file | 3.1.0-1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-wagon-http | 3.1.0-1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-wagon-http-shared | 3.1.0-1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | maven-wagon-provider-api | 3.1.0-1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | plexus-cipher | 1.7-17.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | plexus-cipher | 1.7-14.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | plexus-classworlds | 2.5.2-9.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | plexus-classworlds | 2.6.0-4.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | plexus-containers-component-annotations | 1.7.1-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | plexus-containers-component-annotations | 2.1.0-2.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | plexus-interpolation | 1.22-9.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | plexus-interpolation | 1.26-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | plexus-sec-dispatcher | 1.4-26.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | plexus-sec-dispatcher | 1.4-29.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | plexus-utils | 3.3.0-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | plexus-utils | 3.1.0-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | sisu | 0.3.4-2.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | sisu-inject | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | sisu-plexus | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | slf4j | 1.7.28-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux:8 | slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux:8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | ALSA-2022:1861 |
| Debian:12 | httpcomponents-client | 4.5.13-1 | DEBIAN-CVE-2020-13956 |
| Debian:13 | httpcomponents-client | 4.5.13-1 | DEBIAN-CVE-2020-13956 |
| Debian:14 | httpcomponents-client | 4.5.13-1 | DEBIAN-CVE-2020-13956 |
| Maven | org.apache.httpcomponents:httpclient | 4.5.13 | GHSA-7r82-7xv7-xcpj |
| Maven | org.apache.httpcomponents:httpclient | 5.0.3 | GHSA-7r82-7xv7-xcpj |
| Rocky Linux:8 | aopalliance | 0:1.0-17.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | aopalliance | 0:1.0-20.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | aopalliance | 0:1.0-17.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | aopalliance | 0:1.0-17.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | aopalliance | 0:1.0-20.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-cli | 0:1.4-7.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-cli | 0:1.4-4.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-cli | 0:1.4-4.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-cli | 0:1.4-4.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-cli | 0:1.4-7.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-codec | 0:1.13-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-codec | 0:1.11-3.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-codec | 0:1.11-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-codec | 0:1.11-3.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-codec | 0:1.13-3.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-io | 1:2.6-6.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-io | 1:2.6-6.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-io | 1:2.6-3.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-io | 1:2.6-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-io | 1:2.6-3.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-lang3 | 0:3.9-4.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-lang3 | 0:3.7-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-lang3 | 0:3.9-4.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | apache-commons-lang3 | 0:3.7-3.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-lang3 | 0:3.7-3.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-logging | 0:1.2-13.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | apache-commons-logging | 0:1.2-13.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | atinject | 0:1-31.20100611svn86.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | atinject | 0:1-28.20100611svn86.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | atinject | 0:1-31.20100611svn86.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | atinject | 0:1-28.20100611svn86.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | atinject | 0:1-28.20100611svn86.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | cdi-api | 0:2.0.1-3.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | cdi-api | 0:1.2-8.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | cdi-api | 0:1.2-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | cdi-api | 0:1.2-8.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | cdi-api | 0:2.0.1-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | geronimo-annotation | 0:1.0-23.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | geronimo-annotation | 0:1.0-26.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | geronimo-annotation | 0:1.0-26.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | geronimo-annotation | 0:1.0-23.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | geronimo-annotation | 0:1.0-23.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | glassfish-el | 0:3.0.1-0.7.b08.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | glassfish-el | 0:3.0.1-0.7.b08.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | glassfish-el | 0:3.0.1-0.7.b08.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | glassfish-el | 0:3.0.1-0.7.b08.module+el8.6.0+975+c0ed2db8 | RLSA-2022:1861 |
| Rocky Linux:8 | google-guice | 0:4.2.2-4.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | google-guice | 0:4.1-11.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | google-guice | 0:4.1-11.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | google-guice | 0:4.1-11.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | google-guice | 0:4.2.2-4.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | guava | 0:28.1-3.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | guava | 0:28.1-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | guava20 | 0:20.0-8.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | guava20 | 0:20.0-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | hawtjni | 0:1.16-2.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | hawtjni | 0:1.16-2.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | httpcomponents-client | 0:4.5.5-5.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | httpcomponents-client | 0:4.5.10-4.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | httpcomponents-core | 0:4.4.10-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | httpcomponents-core | 0:4.4.10-3.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | httpcomponents-core | 0:4.4.12-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | httpcomponents-core | 0:4.4.12-3.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | httpcomponents-core | 0:4.4.10-3.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | jansi | 0:1.18-4.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | jansi | 0:1.17.1-1.module+el8.3.0+241+f23502a8 | RLSA-2022:1861 |
| Rocky Linux:8 | jansi | 0:1.17.1-1.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | jansi | 0:1.17.1-1.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | jansi | 0:1.18-4.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | jansi-native | 0:1.7-7.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | jansi-native | 0:1.7-7.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | jboss-interceptors-1.2-api | 0:1.0.0-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | jboss-interceptors-1.2-api | 0:1.0.0-8.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | jsoup | 0:1.12.1-3.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | jsoup | 0:1.12.1-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | jsoup | 0:1.11.3-3.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | jsoup | 0:1.11.3-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | jsoup | 0:1.11.3-3.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | jsr-305 | 0:0-0.25.20130910svn.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | jsr-305 | 0:0-0.25.20130910svn.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | maven | 1:3.6.2-7.module+el8.6.0+976+839b99e9 | RLSA-2022:1860 |
| Rocky Linux:8 | maven | 1:3.6.2-7.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | maven | 1:3.5.4-5.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | maven | 1:3.5.4-5.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | maven | 1:3.5.4-5.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | maven | 1:3.5.4-5.module+el8.6.0+975+c0ed2db8 | RLSA-2022:1861 |
| Rocky Linux:8 | maven-resolver | 0:1.4.1-3.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | maven-resolver | 0:1.4.1-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | maven-resolver | 1:1.1.1-2.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | maven-resolver | 1:1.1.1-2.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | maven-resolver | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | maven-shared-utils | 0:3.2.1-0.1.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | maven-shared-utils | 0:3.2.1-0.4.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | maven-shared-utils | 0:3.2.1-0.4.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | maven-shared-utils | 0:3.2.1-0.1.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | maven-shared-utils | 0:3.2.1-0.1.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | maven-wagon | 0:3.1.0-1.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | maven-wagon | 0:3.3.4-2.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | maven-wagon | 0:3.3.4-2.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | maven-wagon | 0:3.1.0-1.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | maven-wagon | 0:3.1.0-1.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-cipher | 0:1.7-14.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-cipher | 0:1.7-14.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-cipher | 0:1.7-14.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-cipher | 0:1.7-17.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | plexus-cipher | 0:1.7-17.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | plexus-classworlds | 0:2.5.2-9.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-classworlds | 0:2.6.0-4.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | plexus-classworlds | 0:2.5.2-9.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-classworlds | 0:2.6.0-4.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | plexus-classworlds | 0:2.5.2-9.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-containers | 0:2.1.0-2.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux:8 | plexus-containers | 0:2.1.0-2.module+el8.6.0+844+4401f2ed | RLSA-2022:1860 |
| Rocky Linux:8 | plexus-containers | 0:1.7.1-8.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-containers | 0:1.7.1-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-containers | 0:1.7.1-8.module+el8.3.0+133+b8b54b58 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-interpolation | 0:1.22-9.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861 |
| Rocky Linux:8 | plexus-interpolation | 0:1.22-9.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache HttpClient | 4.5.12 and prior, 5.0.2 and prior |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E x_refsource_MISC
- [ranger-dev] 20201204 [jira] [Assigned] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [ranger-dev] 20201204 [jira] [Updated] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [ranger-dev] 20201215 [jira] [Updated] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [ranger-dev] 20201215 [jira] [Commented] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list, x_refsource_MLIST
- [ranger-dev] 20201216 [jira] [Commented] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [lucene-solr-user] 20201229 Upgrade httpclient version due to CVE-2020-13956? mailing-list, x_refsource_MLIST
- [turbine-commits] 20210203 svn commit: r1886168 - in /turbine/core/trunk: ./ conf/ conf/test/ src/java/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/model/ xdocs/howto/ mailing-list, x_refsource_MLIST
- [hive-issues] 20210301 [jira] [Updated] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [hive-issues] 20210301 [jira] [Assigned] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [hive-gitbox] 20210301 [GitHub] [hive] hsnusonic opened a new pull request #2032: HIVE-24837 Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [hive-dev] 20210301 [jira] [Created] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [hive-issues] 20210301 [jira] [Work logged] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [hive-gitbox] 20210302 [GitHub] [hive] hsnusonic closed pull request #2032: HIVE-24837 Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list, x_refsource_MLIST
- [solr-issues] 20210316 [jira] [Resolved] (SOLR-15270) upgrade httpclient to address CVE-2020-13956 mailing-list, x_refsource_MLIST
- [solr-issues] 20210316 [jira] [Created] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list, x_refsource_MLIST
- [solr-issues] 20210316 [jira] [Created] (SOLR-15270) upgrade httpclient to address CVE-2020-13956 mailing-list, x_refsource_MLIST
- [maven-issues] 20210530 [jira] [Updated] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list, x_refsource_MLIST
- [maven-issues] 20210530 [jira] [Resolved] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list, x_refsource_MLIST
- [maven-issues] 20210530 [jira] [Closed] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-issues] 20210604 [jira] [Commented] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-dev] 20210604 [GitHub] [drill] luocooong opened a new pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-dev] 20210604 [jira] [Created] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-issues] 20210604 [jira] [Created] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-dev] 20210604 [GitHub] [drill] cgivre commented on pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-dev] 20210604 [GitHub] [drill] laurentgo merged pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-issues] 20210604 [jira] [Resolved] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-dev] 20210604 [jira] [Resolved] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [drill-commits] 20210604 [drill] branch master updated: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 (#2250) mailing-list, x_refsource_MLIST
- [drill-dev] 20210604 [GitHub] [drill] luocooong commented on pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list, x_refsource_MLIST
- [creadur-commits] 20210608 [jira] [Work started] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list, x_refsource_MLIST
- [creadur-commits] 20210608 [jira] [Resolved] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list, x_refsource_MLIST
- [creadur-commits] 20210608 [jira] [Commented] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list, x_refsource_MLIST
- [creadur-commits] 20210608 [jira] [Created] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list, x_refsource_MLIST
- [creadur-commits] 20210608 [jira] [Assigned] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- [maven-issues] 20210621 [jira] [Assigned] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list, x_refsource_MLIST
- [creadur-dev] 20210621 [jira] [Updated] (RAT-275) Update httpclient to fix CVE-2020-13956 once a new doxia-core release is available mailing-list, x_refsource_MLIST
- [solr-issues] 20210623 [jira] [Updated] (SOLR-15270) upgrade httpclient to address CVE-2020-13956 mailing-list, x_refsource_MLIST