CVE-2020-13956
Medium
Description
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Apache Httpclient
PublishedDec 2, 2020
First seenDec 2, 2020
Weakness typeCWE-20Improper input validation
How to fix
Update
- apache httpclient4.5.13, 5.0.3 or later
- quarkus quarkus1.7.6 or later
- oracle jd_edwards_enterpriseone_orchestrator9.2.6.0 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.0 or later
- oracle nosql_database20.3 or later
- oracle spatial_studio20.1.1 or later
- oracle sql_developer20.4.1.407.0006, 21.99 or later
- org.apache.httpcomponents:httpclient4.5.13, 5.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache httpclient | v < 4.5.13, 5.0.0 ≤ v < 5.0.3 | 4.5.13, 5.0.3 |
| quarkus quarkus | v < 1.7.6 | 1.7.6 |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle jd_edwards_enterpriseone_orchestrator | v < 9.2.6.0 | 9.2.6.0 |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.0 | 9.2.6.0 |
| oracle nosql_database | v < 20.3 | 20.3 |
| oracle peoplesoft_enterprise_peopletools | 8.57, 8.58 | — |
| oracle peoplesoft_enterprise_pt_peopletools | 8.57, 8.58, 8.59 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 16.1, 16.2, 18.8, 19.12, 20.12 | — |
| oracle retail_customer_management_and_segmentation_foundation | 16.0 ≤ v ≤ 19.0 | — |
| oracle spatial_studio | v < 20.1.1 | 20.1.1 |
| oracle sql_developer | v < 20.4.1.407.0006, v < 21.99 | 20.4.1.407.0006, 21.99 |
| netapp active_iq_unified_manager | No range specified | — |
| netapp snapcenter | No range specified | — |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle communications_cloud_native_core_service_communication_proxy | 1.14.0 | — |
| oracle weblogic_server | 12.2.1.4.0, 14.1.1.0.0 | — |
| org.apache.httpcomponents:httpclientMaven | v < 4.5.13, 5.0.0 ≤ v < 5.0.3 | 4.5.13, 5.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.