This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-13956 →
UBUNTU-CVE-2020-13956
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as j...
Original description
The description as published by the source.
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1ubuntu0.1+esm2"}]}]
Ubuntu:Pro:16.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1ubuntu0.1~esm1"}]}]
Ubuntu:Pro:18.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1ubuntu0.1~esm1"}]}]
Ubuntu:Pro:20.04:LTS
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.11-1ubuntu0.1~esm1"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report bugzilla.redhat.com
- report cve.org