Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.httpcomponents:httpclient

6 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 medium
Registry
Maven Central

Advisories 6

  • CVE-2020-13956Medium 5.3

    Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the li

    Affected: fixed in 4.5.13; from 5.0.0, fixed in 5.0.3.

  • http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null…

    Affected: from 4.3, fixed in 4.3.1.

  • http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout…

    Affected: fixed in 4.3.6.

  • http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a…

    Affected: fixed in 4.2.3.

  • org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not…

    Affected: fixed in 4.3.5.

  • Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization…

    Affected: from 4.0.0, fixed in 4.1.1.