Summary
Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information.
Security Fix(es):
* apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | aopalliance | 1.0-20.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | apache-commons-cli | 1.4-7.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | apache-commons-codec | 1.13-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | apache-commons-io | 1:2.6-6.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | apache-commons-lang3 | 3.9-4.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | atinject | 1-31.20100611svn86.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | cdi-api | 2.0.1-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | geronimo-annotation | 1.0-26.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | google-guice | 4.2.2-4.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | guava | 28.1-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | httpcomponents-client | 4.5.10-4.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | httpcomponents-core | 4.4.12-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | jansi | 1.18-4.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | jcl-over-slf4j | 1.7.28-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | jsoup | 1.12.1-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | jsr-305 | 0-0.25.20130910svn.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-lib | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-openjdk11 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-openjdk17 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-openjdk8 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-resolver | 1.4.1-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-shared-utils | 3.2.1-0.4.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | maven-wagon | 3.3.4-2.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | plexus-cipher | 1.7-17.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | plexus-classworlds | 2.6.0-4.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | plexus-containers-component-annotations | 2.1.0-2.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | plexus-interpolation | 1.26-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | plexus-sec-dispatcher | 1.4-29.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | plexus-utils | 3.3.0-3.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | sisu | 0.3.4-2.module_el8.6.0+2786+d7c38b21 |
| AlmaLinux · 8 | slf4j | 1.7.28-3.module_el8.6.0+2786+d7c38b21 |
Vulnerabilities 1
-
Medium 5.3
Cross-site scripting in Apache HttpClient
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
References
-
report
https://vulners.com/cve/CVE-2020-13956