[SOLR-15269] upgrade httpclient to address CVE-2020-13956

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.8.1
• Fix Version/s: 8.11, 8.10.1
• Component/s: security
• Labels: security
• Assignee: Mike Drob
• Reporter: Xiaobin Dai
• Created: 16/Mar/21 14:10
• Updated: 19/Oct/21 19:17
• Resolved: 11/Oct/21 23:31

Description

According to CVE-2020-13956 https://nvd.nist.gov/vuln/detail/CVE-2020-13956

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can
misinterpret malformed authority component in request URIs passed to
the library as java.net.URI object and pick the wrong target host for
request execution.

Issue Links

• Blocked: SOLR-15270 upgrade httpclient to address CVE-2020-13956
• is related to: SOLR-15002 Upgrade HttpClient to 4.5.13
• links to: GitHub Pull Request #2579