VDB
Sign up
MEDIUM5.3

GHSA-7r82-7xv7-xcpj

Cross-site scripting in Apache HttpClient

Quick fix

GHSA-7r82-7xv7-xcpj — org.apache.httpcomponents:httpclient: upgrade to the fixed version with the command below.

# pom.xml: bump <version>4.5.13</version> for org.apache.httpcomponents:httpclient

Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.httpcomponents:httpclient
Introduced in: 0Fixed in: 4.5.13
Fix# pom.xml: bump <version>4.5.13</version> for org.apache.httpcomponents:httpclient
Maven/org.apache.httpcomponents:httpclient
Introduced in: 5.0.0Fixed in: 5.0.3
Fix# pom.xml: bump <version>5.0.3</version> for org.apache.httpcomponents:httpclient

References