CVE Vulnerabilities

CVE-2020-13956

Published: Dec 02, 2020 | Modified: Nov 07, 2023
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
5.3 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Ubuntu
MEDIUM

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Affected Software

Name Vendor Start Version End Version
Httpclient Apache * 4.5.13 (excluding)
Httpclient Apache 5.0.0 (including) 5.0.3 (excluding)
Red Hat AMQ 7.9.0 RedHat httpclient *
Red Hat build of Quarkus 1.7.6 RedHat httpclient *
Red Hat Enterprise Linux 8 RedHat maven:3.6-8060020211119162118.5dbfe8be *
Red Hat Enterprise Linux 8 RedHat maven:3.5-8060020211117110044.c0229ad2 *
Red Hat Fuse 7.12 RedHat *
Red Hat Fuse 7.9 RedHat httpclient *
Red Hat Integration - Camel K - Tech-Preview 3 RedHat httpclient *
Red Hat JBoss Enterprise Application Platform 7 RedHat httpclient *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-activemq-artemis-0:2.9.0-7.redhat_00017.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-glassfish-jsf-0:2.3.9-12.SP13_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-hal-console-0:3.2.12-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-hibernate-0:5.3.20-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-httpcomponents-client-0:4.5.13-1.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-jboss-ejb-client-0:4.0.37-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-jboss-genericjms-0:2.0.8-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-jboss-modules-0:1.11.0-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-jboss-remoting-0:5.0.20-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-jboss-server-migration-0:1.7.2-4.Final_redhat_00005.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-jboss-xnio-base-0:3.7.12-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-narayana-0:5.9.10-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-opentracing-interceptors-0:0.0.4.1-2.redhat_00002.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-resteasy-0:3.11.3-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-undertow-0:2.0.33-1.SP2_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-wildfly-0:7.3.5-2.GA_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-wildfly-discovery-0:1.2.1-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-wildfly-elytron-0:1.10.10-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 RedHat eap7-wildfly-http-client-0:1.0.24-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-activemq-artemis-0:2.9.0-7.redhat_00017.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-glassfish-jsf-0:2.3.9-12.SP13_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-hal-console-0:3.2.12-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-hibernate-0:5.3.20-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-httpcomponents-client-0:4.5.13-1.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-jboss-ejb-client-0:4.0.37-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-jboss-genericjms-0:2.0.8-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-jboss-modules-0:1.11.0-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-jboss-remoting-0:5.0.20-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-jboss-server-migration-0:1.7.2-4.Final_redhat_00005.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-jboss-xnio-base-0:3.7.12-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-narayana-0:5.9.10-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-opentracing-interceptors-0:0.0.4.1-2.redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-resteasy-0:3.11.3-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-undertow-0:2.0.33-1.SP2_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-wildfly-0:7.3.5-2.GA_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-wildfly-discovery-0:1.2.1-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-wildfly-elytron-0:1.10.10-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 RedHat eap7-wildfly-http-client-0:1.0.24-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-activemq-artemis-0:2.9.0-7.redhat_00017.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-glassfish-jsf-0:2.3.9-12.SP13_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-hal-console-0:3.2.12-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-hibernate-0:5.3.20-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-httpcomponents-client-0:4.5.13-1.redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-jboss-ejb-client-0:4.0.37-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-jboss-genericjms-0:2.0.8-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-jboss-modules-0:1.11.0-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-jboss-remoting-0:5.0.20-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-jboss-server-migration-0:1.7.2-4.Final_redhat_00005.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-jboss-xnio-base-0:3.7.12-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-narayana-0:5.9.10-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-opentracing-interceptors-0:0.0.4.1-2.redhat_00002.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-resteasy-0:3.11.3-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-undertow-0:2.0.33-1.SP2_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-wildfly-0:7.3.5-2.GA_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-wildfly-discovery-0:1.2.1-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-wildfly-elytron-0:1.10.10-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 RedHat eap7-wildfly-http-client-0:1.0.24-1.Final_redhat_00001.1.el8eap *
Red Hat Single Sign-On 7.4.5 RedHat httpclient *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-maven36-httpcomponents-client-0:4.5.9-1.3.el7 *
RHDM 7.10.0 RedHat httpclient *
RHINT Service Registry 2.0.2 GA RedHat httpclient *
RHPAM 7.10.1 RedHat httpclient *
Httpcomponents-client Ubuntu bionic *
Httpcomponents-client Ubuntu esm-apps/bionic *
Httpcomponents-client Ubuntu esm-apps/focal *
Httpcomponents-client Ubuntu esm-apps/xenial *
Httpcomponents-client Ubuntu focal *
Httpcomponents-client Ubuntu groovy *
Httpcomponents-client Ubuntu trusty *
Httpcomponents-client Ubuntu trusty/esm *
Httpcomponents-client Ubuntu upstream *
Httpcomponents-client Ubuntu xenial *

References