VDB
RHSA-2021%3A0084
RHSA-2021%3A0084
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Quarkus 1.7.6 |
Timeline
- Jan 12, 2021 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2021:0084 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=1.7.6 advisory
- https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/1.7/ advisory
- https://access.redhat.com/articles/4966181 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1886587 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0084.json advisory
- https://access.redhat.com/security/cve/CVE-2020-13956 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-13956 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-13956 advisory
- https://www.openwall.com/lists/oss-security/2020/10/08/4 advisory