[CVE-2020-13956] Apache HttpClient incorrect handling of malformed URI authority component

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
[CVE-2020-13956] Apache HttpClient incorrect handling of malformed URI authority component

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Oleg Kalnichevski &lt;olegk () apache org&gt;

Date: Thu, 08 Oct 2020 12:56:47 +0200

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
CVE-2020-13956: Apache HttpClient incorrect handling of malformed
authority component in request URIs

Severity: Medium

Vendor:
The Apache Software Foundation

Versions Affected:
Apache HttpClient 4.5.12 and prior 
Apache HttpClient 5.0.2 and prior

Description:

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can
misinterpret malformed authority component in request URIs passed to
the library as java.net.URI object and pick the wrong target host for
request execution.  

Mitigation:

As of release 4.5.13 and 5.0.3 HttpClient will reject URIs with
ambiguous malformed authority component as invalid. Users of HttpClient
are advised to upgrade to version 4.5.13 or 5.0.3 and sanitize request
URIs when using java.net.URI as input.

Credit:
This issue was discovered and reported by Priyank Nigam

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

[CVE-2020-13956] Apache HttpClient incorrect handling of malformed URI authority component Oleg Kalnichevski (Oct 08)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->