[HDDS-4464] Upgrade httpclient version due to CVE-2020-13956

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Labels: pull-request-available
• Assignee: Tsz-wo Sze
• Reporter: Tsz-wo Sze
• Created: 14/Nov/20 10:34
• Updated: 17/Nov/20 13:36
• Resolved: 16/Nov/20 23:59

Description

According to CVE-2020-13956 https://www.openwall.com/lists/oss-security/2020/10/08/4 ,

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can
misinterpret malformed authority component in request URIs passed to
the library as java.net.URI object and pick the wrong target host for
request execution.

Issue Links

• relates to: HADOOP-17223 update org.apache.httpcomponents:httpclient to 4.5.13 and httpcore to 4.4.13
• links to: GitHub Pull Request #1590