[NIFI-10084] Upgrade commons-httpclient

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.16.1, 1.16.2
• Assignee: David Handermann
• Reporter: Mike R
• Created: 02/Jun/22 12:28
• Updated: 02/May/23 15:10
• Resolved: 02/May/23 15:09

Description

It looks like commons-httpclient-3.1, which is found at nifi-toolkit-current/lib/commons-httpclient-3.1.jar is vulnerable to a CVE and is end of life. The CVE is https://nvd.nist.gov/vuln/detail/CVE-2012-5783

There is also CVE 2020-13956

When I look for updates, it looks like the end of life was 16 December 2007, with the newer module being Maven Repository: org.apache.httpcomponents » httpclient (mvnrepository.com)

More information can be found from the apache website

The vulnerable component is found at /nifi-toolkit/lib/commons-httpclient-3.1.jar.

 

Issue Links

• is fixed by: NIFI-11169 Remove Deprecated Components and Features for 2.0.0 M1
• is fixed by: NIFI-9849 Refactor SAML 2 Support using Spring Security 5
• relates to: NIFI-9849 Refactor SAML 2 Support using Spring Security 5