Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-13956 →
UBUNTU-CVE-2020-13956
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as j...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:14.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1ubuntu0.1+esm2"}]}]
Ubuntu:Pro:16.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1ubuntu0.1~esm1"}]}]
Ubuntu:Pro:18.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1ubuntu0.1~esm1"}]}]
Ubuntu:Pro:20.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.11-1ubuntu0.1~esm1"}]}]
Références
- advisory ubuntu.com
- report ubuntu.com
- report bugzilla.redhat.com
- report cve.org