Description
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache HttpClient | 4.5.12 and prior, 5.0.2 and prior | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | httpcomponents-client | 4.5.13-1 | — |
| Debian 13 | httpcomponents-client | 4.5.13-1 | — |
| Debian 12 | httpcomponents-client | 4.5.13-1 | — |
| Debian 10 | httpcomponents-client | 4.5.7-1+deb10u1 | DSA-4772-1 |
| Debian 9 | httpcomponents-client | 4.5.2-2+deb9u1 | DLA-2405-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | httpcomponents-client | 4.5.11-1ubuntu0.1~esm1 | USN-5239-1 |
| Ubuntu Pro 18.04 LTS | httpcomponents-client | 4.5.5-1ubuntu0.1~esm1 | USN-5239-1 |
| Ubuntu Pro 16.04 LTS | httpcomponents-client | 4.5.1-1ubuntu0.1~esm1 | USN-5239-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | httpcomponents-client | 4.3.3-1ubuntu0.1+esm2 | USN-5239-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | aopalliance | 1.0-17.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | apache-commons-cli | 1.4-4.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | apache-commons-codec | 1.11-3.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | apache-commons-io | 1:2.6-3.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | apache-commons-lang3 | 3.7-3.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | apache-commons-logging | 1.2-13.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | atinject | 1-28.20100611svn86.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | cdi-api | 1.2-8.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | geronimo-annotation | 1.0-23.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | glassfish-el +1 | 3.0.1-0.7.b08.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | google-guice | 4.1-11.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | guava | 28.1-3.module+el8.6.0+13337+afcb49ec | RHSA-2022:1860 |
| RHEL 8 | guava20 | 20.0-8.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | hawtjni +1 | 1.16-2.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | httpcomponents-client | 4.5.5-5.module+el8.6.0+13298+7b5243c0 | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | httpcomponents-core | 4.4.10-3.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | jansi | 1.17.1-1.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | jansi-native | 1.7-7.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | jboss-interceptors-1.2-api | 1.0.0-8.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | jsoup | 1.11.3-3.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | jsr-305 | 0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | RHSA-2022:1860 |
| RHEL 8 | maven +1 | 1:3.5.4-5.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | maven-openjdk8 +2 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | RHSA-2022:1860 |
| RHEL 8 | maven-resolver | 1.4.1-3.module+el8.6.0+13337+afcb49ec | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | maven-resolver-api +5 | 1:1.1.1-2.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | maven-shared-utils | 3.2.1-0.1.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | maven-wagon +4 | 3.1.0-1.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | plexus-cipher | 1.7-14.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | plexus-classworlds | 2.5.2-9.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | plexus-containers +1 | 1.7.1-8.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | plexus-interpolation | 1.22-9.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | plexus-sec-dispatcher | 1.4-26.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | plexus-utils | 3.1.0-3.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | sisu | 0.3.4-2.module+el8.6.0+13337+afcb49ec | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 8 | sisu-inject +1 | 1:0.3.3-6.module+el8+2452+b359bfcd | RHSA-2022:1861 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8+2452+b359bfcd | RHSA-2022:1861, RHSA-2022:1860 |
| RHEL 3 | rh-maven36-httpcomponents-client +1 | 4.5.9-1.3.el7 | RHSA-2022:0722 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-7.redhat_00017.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.9-12.SP13_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.12-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.20-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-client | 4.5.13-1.redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.37-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.11.0-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-4.Final_redhat_00005.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.12-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.10-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-opentracing-interceptors | 0.0.4.1-2.redhat_00002.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.11.3-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.33-1.SP2_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.5-2.GA_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-wildfly-discovery +1 | 1.2.1-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.10-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.24-1.Final_redhat_00001.1.el6eap | RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.5-2.GA_redhat_00001.1.el7eap | RHSA-2021:0247 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | aopalliance | 1.0-17.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | apache-commons-cli | 1.4-4.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | apache-commons-codec | 1.11-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | apache-commons-io | 1:2.6-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | apache-commons-lang3 | 3.7-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | apache-commons-logging | 1.2-13.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | atinject | 1-28.20100611svn86.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | cdi-api | 1.2-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | geronimo-annotation | 1.0-23.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | glassfish-el-api | 3.0.1-0.7.b08.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | google-guice | 4.1-11.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | guava | 28.1-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux 8 | guava20 | 20.0-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | hawtjni-runtime | 1.16-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | httpcomponents-client | 4.5.5-5.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | httpcomponents-core | 4.4.10-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | jansi | 1.17.1-1.module_el8.0.0+6044+f3cbc35d | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | jansi-native | 1.7-7.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | jboss-interceptors-1.2-api | 1.0.0-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | jcl-over-slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | jsoup | 1.11.3-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | jsr-305 | 0-0.25.20130910svn.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux 8 | maven +1 | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | maven-openjdk8 +2 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux 8 | maven-resolver | 1.4.1-3.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux 8 | maven-resolver-api +5 | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | maven-shared-utils | 3.2.1-0.1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | maven-wagon | 3.3.4-2.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux 8 | maven-wagon-file +3 | 3.1.0-1.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | plexus-cipher | 1.7-14.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | plexus-classworlds | 2.5.2-9.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | plexus-containers-component-annotations | 1.7.1-8.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | plexus-interpolation | 1.22-9.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | plexus-sec-dispatcher | 1.4-26.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | plexus-utils | 3.1.0-3.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861, ALSA-2022:1860 |
| AlmaLinux 8 | sisu | 0.3.4-2.module_el8.6.0+2786+d7c38b21 | ALSA-2022:1860 |
| AlmaLinux 8 | sisu-inject +1 | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e | ALSA-2022:1861 |
| AlmaLinux 8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | ALSA-2022:1861, ALSA-2022:1860 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | aopalliance | 1.0-17.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | apache-commons-cli | 1.4-4.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | apache-commons-codec | 1.11-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | apache-commons-io | 1:2.6-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | apache-commons-lang3 | 3.7-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | apache-commons-logging | 1.2-13.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux 8 | atinject | 1-28.20100611svn86.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | cdi-api | 1.2-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | geronimo-annotation | 1.0-23.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | glassfish-el | 3.0.1-0.7.b08.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux 8 | google-guice | 4.1-11.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | guava | 28.1-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux 8 | guava20 | 20.0-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux 8 | hawtjni | 1.16-2.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux 8 | httpcomponents-client | 4.5.5-5.module+el8.6.0+843+5a13dac3 | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | httpcomponents-core | 4.4.10-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | jansi | 1.17.1-1.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | jansi-native | 1.7-7.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux 8 | jboss-interceptors-1.2-api | 1.0.0-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861 |
| Rocky Linux 8 | jsoup | 1.11.3-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | jsr-305 | 0-0.25.20130910svn.module+el8.3.0+134+f7791fe0 | RLSA-2022:1860 |
| Rocky Linux 8 | maven | 1:3.5.4-5.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | maven-resolver | 1.4.1-3.module+el8.3.0+134+f7791fe0 | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | maven-shared-utils | 3.2.1-0.1.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | maven-wagon | 3.1.0-1.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | plexus-cipher | 1.7-14.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | plexus-classworlds | 2.5.2-9.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | plexus-containers | 1.7.1-8.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | plexus-interpolation | 1.22-9.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | plexus-sec-dispatcher | 1.4-26.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | plexus-utils | 3.1.0-3.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | sisu | 0.3.4-2.module+el8.3.0+134+f7791fe0 | RLSA-2022:1861, RLSA-2022:1860 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2022:1861, RLSA-2022:1860 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | httpcomponents-client | 4.5.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| SLES 15 SP6 | httpcomponents-core | 4.4.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| SLES 15 SP5 | httpcomponents-client | 4.5.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| SLES 15 SP5 | httpcomponents-core | 4.4.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.3 | httpcomponents-client | 4.5.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| SUSE Manager Server Module 4.3 | httpcomponents-core | 4.4.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clojure | 1.10.3.855-1.2 | openSUSE-SU-2024:10687-1 |
| openSUSE Tumbleweed | httpcomponents-client | 4.5.14-1.1 | openSUSE-SU-2024:14478-1 |
| openSUSE Leap 15.6 | httpcomponents-client | 4.5.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| openSUSE Leap 15.6 | httpcomponents-core | 4.4.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| openSUSE Leap 15.5 | httpcomponents-client | 4.5.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
| openSUSE Leap 15.5 | httpcomponents-core | 4.4.14-150200.3.9.1 | SUSE-SU-2024:4036-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | httpcomponents-client +1 | 4.2.5-5.amzn2.0.1 | ALAS2-2023-1946 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | aopalliance | 1.0-17.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | apache-commons-cli | 1.4-4.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | apache-commons-codec | 1.11-3.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | apache-commons-io | 1:2.6-3.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | apache-commons-lang3 | 3.7-3.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | apache-commons-logging | 1.2-13.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | atinject | 1-28.20100611svn86.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | cdi-api | 1.2-8.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | geronimo-annotation | 1.0-23.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | glassfish-el-api | 3.0.1-0.7.b08.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | google-guice | 4.1-11.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | guava | 28.1-3.module+el8.6.0+20615+edd0bff8 | ELSA-2022-1860 |
| Oracle Linux 8 | guava20 | 20.0-8.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | hawtjni-runtime | 1.16-2.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | httpcomponents-client | 4.5.5-5.module+el8.6.0+20537+63b96daa | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | httpcomponents-core | 4.4.10-3.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | jansi | 1.17.1-1.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | jansi-native | 1.7-7.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | jboss-interceptors-1.2-api | 1.0.0-8.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | jsoup | 1.11.3-3.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | jsr-305 | 0-0.25.20130910svn.module+el8.6.0+20615+edd0bff8 | ELSA-2022-1860 |
| Oracle Linux 8 | maven +1 | 1:3.5.4-5.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | maven-openjdk8 +2 | 1:3.6.2-7.module+el8.6.0+20615+edd0bff8 | ELSA-2022-1860 |
| Oracle Linux 8 | maven-resolver | 1.4.1-3.module+el8.6.0+20615+edd0bff8 | ELSA-2022-1860 |
| Oracle Linux 8 | maven-resolver-api +5 | 1:1.1.1-2.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | maven-shared-utils | 3.2.1-0.1.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | maven-wagon | 3.3.4-2.module+el8.6.0+20615+edd0bff8 | ELSA-2022-1860 |
| Oracle Linux 8 | maven-wagon-file +3 | 3.1.0-1.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | plexus-cipher | 1.7-14.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | plexus-classworlds | 2.5.2-9.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | plexus-containers-component-annotations | 1.7.1-8.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | plexus-interpolation | 1.22-9.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | plexus-sec-dispatcher | 1.4-26.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | plexus-utils | 3.1.0-3.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
| Oracle Linux 8 | sisu | 0.3.4-2.module+el8.6.0+20615+edd0bff8 | ELSA-2022-1860 |
| Oracle Linux 8 | sisu-inject +1 | 1:0.3.3-6.module+el8+5161+5cac467c | ELSA-2022-1861 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8+5161+5cac467c | ELSA-2022-1861, ELSA-2022-1860 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 35.0.1-r1 | — |
| Wolfi rolling | trino +58 | 440-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | < 4.5.13 | 4.5.13 | GHSA-7r82-7xv7-xcpj |
| Maven | org.apache.httpcomponents:httpclient | >= 5.0.0, < 5.0.3 | 5.0.3 | GHSA-7r82-7xv7-xcpj |
Advisories 38
- ALSA-2022:1861 Moderate: maven:3.5 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:1860 Moderate: maven:3.6 security and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:1861 Red Hat Security Advisory: maven:3.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1860 Red Hat Security Advisory: maven:3.6 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0722 Red Hat Security Advisory: rh-maven36-httpcomponents-client security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0247 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0248 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0246 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-5239-1 httpcomponents-client vulnerability Ubuntu Security Notices (USN) · Oct 12, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-1637 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- DSA-4772-1 httpcomponents-client - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2405-1 httpcomponents-client - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:1860 Moderate: maven:3.6 security and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2022:1861 Moderate: maven:3.5 security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:14478-1 httpcomponents-client-4.5.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4036-1 Security update for httpcomponents-client, httpcomponents-core SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10687-1 clojure-1.10.3.855-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2025-0328 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-2372 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2025
- WID-SEC-2023-2625 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 6, 2025
- WID-SEC-2022-0044 Apache HttpComponents: Schwachstelle ermöglicht Täuschung des Nutzers BSI CERT-Bund (WID) · Jul 7, 2025
- NCSC-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0413 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3197 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-1872 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 15, 2024
- NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0293 Kwetsbaarheden verholpen in Oracle Communications Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1659 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1643 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2674 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2691 Oracle JD Edwards: Schwachstelle gefährdet Integrität BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
- ALAS2-2023-1946 Moderate: httpcomponents-client security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ELSA-2022-1861 Moderate: maven:3.5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
- ELSA-2022-1860 Moderate: maven:3.6 security and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
References
- https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
- [ranger-dev] 20201204 [jira] [Assigned] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list
- [ranger-dev] 20201204 [jira] [Updated] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list
- [ranger-dev] 20201215 [jira] [Updated] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list
- [ranger-dev] 20201215 [jira] [Commented] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- [ranger-dev] 20201216 [jira] [Commented] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list
- [lucene-solr-user] 20201229 Upgrade httpclient version due to CVE-2020-13956? mailing-list
- [turbine-commits] 20210203 svn commit: r1886168 - in /turbine/core/trunk: ./ conf/ conf/test/ src/java/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/model/ xdocs/ mailing-list
- [hive-issues] 20210301 [jira] [Updated] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list
- [hive-issues] 20210301 [jira] [Assigned] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list
- [hive-gitbox] 20210301 [GitHub] [hive] hsnusonic opened a new pull request #2032: HIVE-24837 Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list
- [hive-dev] 20210301 [jira] [Created] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list
- [hive-issues] 20210301 [jira] [Work logged] (HIVE-24837) Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list
- [hive-gitbox] 20210302 [GitHub] [hive] hsnusonic closed pull request #2032: HIVE-24837 Upgrade httpclient to 4.5.13+ due to CVE-2020-13956 mailing-list
- [solr-issues] 20210316 [jira] [Resolved] (SOLR-15270) upgrade httpclient to address CVE-2020-13956 mailing-list
- [solr-issues] 20210316 [jira] [Created] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list
- [solr-issues] 20210316 [jira] [Created] (SOLR-15270) upgrade httpclient to address CVE-2020-13956 mailing-list
- [maven-issues] 20210530 [jira] [Updated] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list
- [maven-issues] 20210530 [jira] [Resolved] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list
- [maven-issues] 20210530 [jira] [Closed] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list
- [drill-issues] 20210604 [jira] [Commented] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-dev] 20210604 [GitHub] [drill] luocooong opened a new pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-dev] 20210604 [jira] [Created] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-issues] 20210604 [jira] [Created] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-dev] 20210604 [GitHub] [drill] cgivre commented on pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-dev] 20210604 [GitHub] [drill] laurentgo merged pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-issues] 20210604 [jira] [Resolved] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-dev] 20210604 [jira] [Resolved] (DRILL-7946) Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [drill-commits] 20210604 [drill] branch master updated: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 (#2250) mailing-list
- [drill-dev] 20210604 [GitHub] [drill] luocooong commented on pull request #2250: DRILL-7946: Bump HttpClient from 4.5.12 to 4.5.13 for CVE-2020-13956 mailing-list
- [creadur-commits] 20210608 [jira] [Work started] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list
- [creadur-commits] 20210608 [jira] [Resolved] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list
- [creadur-commits] 20210608 [jira] [Commented] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list
- [creadur-commits] 20210608 [jira] [Created] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list
- [creadur-commits] 20210608 [jira] [Assigned] (TENTACLES-13) Upgrade httpclient to circumvent CVE-2020-13956 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [maven-issues] 20210621 [jira] [Assigned] (DOXIA-615) Can you provide an updated version in order to fix CVE-2020-13956 mailing-list
- [creadur-dev] 20210621 [jira] [Updated] (RAT-275) Update httpclient to fix CVE-2020-13956 once a new doxia-core release is available mailing-list
- [solr-issues] 20210623 [jira] [Updated] (SOLR-15270) upgrade httpclient to address CVE-2020-13956 mailing-list
- [solr-issues] 20210623 [jira] [Updated] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list
- [jackrabbit-dev] 20210706 [GitHub] [jackrabbit-oak] reschke commented on pull request #310: OAK-9482: upgrade httpclient to 4.5.13 mailing-list
- [jackrabbit-dev] 20210706 [GitHub] [jackrabbit-oak] reschke removed a comment on pull request #310: OAK-9482: upgrade httpclient to 4.5.13 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- [solr-issues] 20210912 [jira] [Updated] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list
- [bookkeeper-issues] 20210914 [GitHub] [bookkeeper] nicoloboschi opened a new pull request #2793: Upgrade httpclient from 4.5.5 to 4.5.13 to address CVE-2020-13956 mailing-list
- [bookkeeper-issues] 20210917 [GitHub] [bookkeeper] nicoloboschi commented on pull request #2793: Upgrade httpclient from 4.5.5 to 4.5.13 to address CVE-2020-13956 mailing-list
- [lucene-issues] 20210921 [GitHub] [lucene-solr] ventry1990 opened a new pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [lucene-issues] 20210921 [GitHub] [lucene-solr] madrob commented on pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [lucene-issues] 20210921 [GitHub] [lucene-solr] ventry1990 commented on pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [lucene-issues] 20211007 [GitHub] [lucene-solr] madrob commented on pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [lucene-issues] 20211009 [GitHub] [lucene-solr] ventry1990 closed pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [lucene-issues] 20211009 [GitHub] [lucene-solr] ventry1990 commented on pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [lucene-issues] 20211009 [GitHub] [lucene-solr] ventry1990 opened a new pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [solr-issues] 20211011 [jira] [Commented] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list
- [solr-issues] 20211011 [jira] [Resolved] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list
- [lucene-issues] 20211011 [GitHub] [lucene-solr] madrob merged pull request #2579: SOLR-15269: Upgrade Apache HttpComponents Client to 4.5.13 to fix CVE-2020-13956 mailing-list
- [solr-issues] 20211019 [jira] [Closed] (SOLR-15269) upgrade httpclient to address CVE-2020-13956 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- [ranger-dev] 20211028 [jira] [Commented] (RANGER-3100) Upgrade httpclient version from 4.5.6 to 4.5.13+ due to CVE-2020-13956 mailing-list