[SOLR-15270] upgrade httpclient to address CVE-2020-13956

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 8.8.1
• Component/s: security
• Labels: security
• Assignee: Unassigned
• Reporter: Xiaobin Dai
• Created: 16/Mar/21 14:10
• Updated: 23/Jun/21 13:49
• Resolved: 16/Mar/21 14:12

Description

According to CVE-2020-13956 https://nvd.nist.gov/vuln/detail/CVE-2020-13956

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can
misinterpret malformed authority component in request URIs passed to
the library as java.net.URI object and pick the wrong target host for
request execution.

Issue Links

• Blocked: SOLR-15269 upgrade httpclient to address CVE-2020-13956