[RAT-275] Update httpclient to fix CVE-2020-13956 once a new doxia-core release is available

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.13, 0.14
• Fix Version/s: 0.14
• Assignee: Philipp Ottlinger
• Reporter: Philipp Ottlinger
• Created: 11/Oct/20 07:48
• Updated: 23/Dec/21 12:48
• Resolved: 22/Dec/21 22:17

Description

Once a newer doxia version is available update to it in order to fix:

https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1016906

Remediation

Upgrade org.apache.httpcomponents:httpclient to version 4.5.13, 5.0.3 or higher.

 Currently the most up2date doxia uses v4.5.8 of httpclient.

Update

• The branch "update-doxia-tools" tries to update some other outdated components in RAT as well ....
• 2021-06-21: Upcoming release of doxia stuff v1.10 ....

Issue Links

• is blocked by: DOXIA-615 Upgrade HttpClient to 4.5.13