Medium USN-5239-1 1 CVE

httpcomponents-client vulnerability

Published Aug 8, 2022 · Updated Oct 12, 2026

Ecosystem: Ubuntu

Summary

It was discovered that HttpClient mishandled certain input. An attacker could
use this vulnerability to cause a crash or possibly execute arbitrary code.

Fixed packages 4

Release	Package	Fixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	httpcomponents-client	4.3.3-1ubuntu0.1+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	httpcomponents-client	4.5.1-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	httpcomponents-client	4.5.5-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	httpcomponents-client	4.5.11-1ubuntu0.1~esm1

Vulnerabilities 1

Medium 5.3

CVE-2020-13956

Cross-site scripting in Apache HttpClient

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

druid trino trino-plugin-opensearch trino-plugin-lakehouse Debian Ubuntu Wolfi Maven

Dec 2, 2020

References

report
https://ubuntu.com/security/CVE-2020-13956