You are viewing a plain text version of this content. The canonical link for it is here.

Posted to solr-user@lucene.apache.org by 戴晓彬 <xi...@foxmail.com> on 2020/12/29 15:55:52 UTC

Upgrade httpclient version due to CVE-2020-13956?

CVE-2020-13956: Apache HttpClient incorrect handling of malformed
authority component in request URIs


Severity: Medium


Vendor:
The Apache Software Foundation


Versions Affected:
Apache HttpClient 4.5.12 and prior&nbsp;
Apache HttpClient 5.0.2 and prior


Description:


Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can
misinterpret malformed authority component in request URIs passed to
the library as java.net.URI object and pick the wrong target host for
request execution.&nbsp;&nbsp;


Mitigation:


As of release 4.5.13 and 5.0.3 HttpClient will reject URIs with
ambiguous malformed authority component as invalid. Users of HttpClient
are advised to upgrade to version 4.5.13 or 5.0.3 and sanitize request
URIs when using java.net.URI as input.


Credit:
This issue was discovered and reported by Priyank Nigam