Input validation error in Apache HttpComponents - CVE-2020-13956

Vulnerability identifier: #VU47481

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13956

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to insufficient validation of user-supplied input in Apache HttpClient. A remote attacker can pass request URIs to the library as java.net.URI object and force the application to pick the wrong target host for request execution.

Apache HttpComponents
Red Hat Software Collections
EntireX
Oracle SQL Developer
Siebel CRM Development
IBM Security Guardium
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Server
SUSE Manager Server Module
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Development Tools Module
openSUSE Leap
Log Analysis
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Intelligent Operations Center
IBM Tivoli Netcool Impact
Oracle Enterprise Data Quality
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Autodesk Infraworks
Netcool Operations Insight
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Control
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
IBM Sterling Connect:Direct Web Services
IBM Cloud Application Performance Management (APM)
NetWorker
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Oracle Communications Cloud Native Core Service Communication Proxy
IBM Cloud Pak System
httpcomponents-client (Debian package)
jsr-305
sisu-inject
sisu-plexus
sisu
jboss-interceptors-1.2-api
aopalliance
geronimo-annotation
maven-resolver-api
maven-resolver-connector-basic
maven-resolver-impl
maven-resolver-spi
maven-resolver-transport-wagon
maven-resolver-util
cdi-api
apache-commons-logging
maven-resolver
apache-commons-cli
plexus-sec-dispatcher
plexus-containers-component-annotations
jansi-native
plexus-cipher
slf4j
jcl-over-slf4j
apache-commons-codec
jsoup
hawtjni-runtime
jansi
plexus-interpolation
atinject
plexus-classworlds
apache-commons-io
glassfish-el-api
maven-wagon-file
maven-wagon-provider-api
maven-wagon-http-shared
maven-wagon-http
plexus-utils
maven-shared-utils
maven-wagon
maven
maven-lib
maven-openjdk11
maven-openjdk17
maven-openjdk8
apache-commons-lang3
google-guice
httpcomponents-core
httpcomponents-core-javadoc
httpcomponents-client
rh-maven36-httpcomponents-client (Red Hat package)
httpcomponents-client-javadoc
httpcomponents-client-cache
guava20
guava
Cognos Dashboards on Cloud Pak for Data
DataStage on Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Oracle Business Intelligence Enterprise Edition
Oracle Data Integrator
Multi-Enterprise Integration Gateway
B2B Advanced Communications
Analytics Content Hub
Telco Service Design Configuration Designer
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
StreamSets Data Collector
Engineering Test Management
IBM Engineering Lifecycle Optimization - Publishing
Telco Network Function Virtualization Orchestrator
CloudLink
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Space Management
Storage Protect Client
Maximo Application Suite - IoT Component
IBM Engineering Systems Design Rhapsody
IBM Sterling Global Mailbox (GM)
IBM Qradar SIEM
Cloud Pak for Security (CP4S)
Jazz Reporting Service
Communications Service Catalog and Design
Voice Gateway
AMQ Broker
Oracle WebLogic Server
Fuse
PeopleSoft Enterprise PT PeopleTools
Oracle Documaker
Operational Decision Manager
IBM Security Verify Access
JD Edwards EnterpriseOne Tools
Primavera Unifier
IBM Disconnected Log Collector
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Business Activity Monitoring
Stream Analytics
Oracle Access Manager
Oracle NoSQL Database
Oracle Essbase
Oracle Spatial Studio
watsonx.data
IBM TRIRIGA Application Platform
IBM TRIRIGA
RSA Authentication Manager

Install updates from vendor's website.

Apache HttpComponents - addressed in versions 4.5.13, 5.0.3
Log Analysis - update to 1.3.7.2 IF003
IBM Cloud Pak System - update to 2.3.3.6
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.6
httpcomponents-client (Debian package) - update to 4.5.7-1+deb10u1
DataStage on Cloud Pak for Data - update to 4.8.5
Knowledge Catalog Premium Cartridge - update to 5.2
IBM Intelligent Operations Center - update to 5.2.3
IBM Sterling Global Mailbox (GM) - addressed in versions 6.0.3.8, 6.1.2.1
IBM Tivoli Netcool Impact - update to 7.1.0.27
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 9, 7.4.3 Fix Pack 1
Communications Service Catalog and Design - update to 7.4.2.8.0
AMQ Broker - update to 7.9.0
EntireX - update to 11.1.1
Stream Analytics - update to 19.1.0.0.8
Oracle NoSQL Database - update to 20.3
Oracle Spatial Studio - update to 20.1.1
Oracle SQL Developer - addressed in versions 20.4.1.407.0006, 21.99
Siebel CRM Development - update to 25.7
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
jsr-305 - update to 0-0.25.20130910svn
sisu-inject - update to 0.3.3-6
sisu-plexus - update to 0.3.3-6
sisu - update to 0.3.4-2
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
jboss-interceptors-1.2-api - update to 1.0.0-8
Voice Gateway - update to 1.0.8.3
aopalliance - addressed in versions 1.0-17, 1.0-20
geronimo-annotation - addressed in versions 1.0-23, 1.0-26
maven-resolver-api - update to 1.1.1-2
maven-resolver-connector-basic - update to 1.1.1-2
maven-resolver-impl - update to 1.1.1-2
maven-resolver-spi - update to 1.1.1-2
maven-resolver-transport-wagon - update to 1.1.1-2
maven-resolver-util - update to 1.1.1-2
cdi-api - addressed in versions 1.2-8, 2.0.1-3
apache-commons-logging - update to 1.2-13
maven-resolver - update to 1.4.1-3
apache-commons-cli - addressed in versions 1.4-4, 1.4-7
plexus-sec-dispatcher - addressed in versions 1.4-26, 1.4-29
IBM Disconnected Log Collector - update to 1.6
Netcool Operations Insight - update to 1.6.6
plexus-containers-component-annotations - addressed in versions 1.7.1-8, 2.1.0-2
jansi-native - update to 1.7-7
plexus-cipher - addressed in versions 1.7-14, 1.7-17
slf4j - addressed in versions 1.7.25-4, 1.7.28-3
jcl-over-slf4j - addressed in versions 1.7.25-4, 1.7.28-3
Cloud Pak for Security (CP4S) - update to 1.10.14.0
apache-commons-codec - addressed in versions 1.11-3, 1.13-3
jsoup - addressed in versions 1.11.3-3, 1.12.1-3
hawtjni-runtime - update to 1.16-2
jansi - addressed in versions 1.17.1-1, 1.18-4
plexus-interpolation - addressed in versions 1.22-9, 1.26-3
atinject - addressed in versions 1-28.20100611svn86, 1-31.20100611svn86
watsonx.data - update to 2.0.3
Analytics Content Hub - update to 2.3
Telco Service Design Configuration Designer - update to 2.3.0
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fixpack 1
plexus-classworlds - addressed in versions 2.5.2-9, 2.6.0-4
apache-commons-io - addressed in versions 2.6-3, 2.6-6
glassfish-el-api - update to 3.0.1-0.7.b08
maven-wagon-file - update to 3.1.0-1
maven-wagon-provider-api - update to 3.1.0-1
maven-wagon-http-shared - update to 3.1.0-1
maven-wagon-http - update to 3.1.0-1
plexus-utils - addressed in versions 3.1.0-3, 3.3.0-3
maven-shared-utils - addressed in versions 3.2.1-0.1, 3.2.1-0.4
maven-wagon - update to 3.3.4-2
maven - addressed in versions 3.5.4-5, 3.6.2-7
maven-lib - addressed in versions 3.5.4-5, 3.6.2-7
IBM TRIRIGA Application Platform - addressed in versions 3.6.1.3, 3.7.0.1, 3.8.0.1, 4.0.2, 4.1.1
IBM TRIRIGA - addressed in versions 3.6.1.3, 3.7.0.1, 3.8.0.1, 4.0.2, 4.1.1
maven-openjdk11 - update to 3.6.2-7
maven-openjdk17 - update to 3.6.2-7
maven-openjdk8 - update to 3.6.2-7
apache-commons-lang3 - addressed in versions 3.7-3, 3.9-4
google-guice - addressed in versions 4.1-11, 4.2.2-4
httpcomponents-core - addressed in versions 4.4.10-3, 4.4.12-3
httpcomponents-core - update to 4.4.14-150200.3.9.1
httpcomponents-core-javadoc - update to 4.4.14-150200.3.9.1
httpcomponents-client - addressed in versions 4.5.5-5, 4.5.10-4
rh-maven36-httpcomponents-client (Red Hat package) - update to 4.5.9-1.3.el7
httpcomponents-client-javadoc - update to 4.5.14-150200.3.9.1
httpcomponents-client - update to 4.5.14-150200.3.9.1
httpcomponents-client-cache - update to 4.5.14-150200.3.9.1
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
IBM Spectrum Control - update to 5.4.10.2
Dell Secure Connect Gateway - update to 5.28.00.14
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.6, 6.1.1.2, 6.1.2.1
IBM Sterling Connect:Direct Web Services - update to 6.3.0.10
StreamSets Data Collector - update to 7.0.0
Engineering Test Management - addressed in versions 7.0.1.0.22, 7.0.2.0.23
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Jazz Reporting Service - update to 7.0.2 iFix022
Telco Network Function Virtualization Orchestrator - update to 7.3.0
Fuse - update to 7.12.0
CloudLink - update to 8.0-3.10.5.1
IBM Cloud Application Performance Management (APM) - addressed in versions 8.1.4.0.16, 8.1.4.0.20
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.20.0
Storage Protect for Space Management - update to 8.1.20.0
Storage Protect Client - update to 8.1.20.0
RSA Authentication Manager - addressed in versions 8.7 Patch 3, 8.7 SP1 Patch 3, 8.7 SP2 Patch 1
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
NetWorker - addressed in versions 19.9.0.6, 19.10.0.3
guava20 - update to 20.0-8
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
guava - update to 28.1-3
IBM Observability with Instana - update to 268

• https://seclists.org/oss-sec/2020/q4/34

• Security restrictions bypass in Apache HttpClient
• Debian update for httpcomponents-client
• Multiple vulnerabilities in Oracle NoSQL Database
• Input validation error in Oracle SQL Developer
• Multiple vulnerabilities in Oracle Spatial Studio
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in PeopleSoft Enterprise PT PeopleTools
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Red Hat Software Collections update for rh-maven36-httpcomponents-client
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle SQL Developer
• Red Hat Enterprise Linux 8 update for the maven:3.6 module
• Red Hat Enterprise Linux 8 update for the maven:3.5 module
• IBM TRIRIGA Application Platform update for Apache HttpComponents
• Multiple vulnerabilities in IBM Security Access Manager
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM QRadar SIEM
• Input validation error in IBM Cloud Pak for Multicloud Management Monitoring
• Security restrictions bypass in IBM Intelligent Operations Center
• Security restrictions bypass in IBM Tivoli Netcool Impact
• IBM Log Analysis update for Apache HttpClient
• Multiple vulnerabilities in Netcool Operations Insight
• Input validation error in IBM Stering B2B Integrator
• Input validation error in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• IBM Sterling Global Mailbox update for Apache HttpClient
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in Dell CloudLink
• Multiple vulnerabilities in APM Linux KVM Agent
• Input validation error in IBM Engineering Test Management (ETM)
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management
• Input validation error in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM B2B Advanced Communications and IBM Multi-Enterprise Integration Gateway
• Multiple vulnerabilities in Oracle WebLogic Server
• Input validation error in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in Dell NetWorker
• Multiple vulnerabilities in Communications Service Catalog and Design
• Input validation error in Oracle Business Activity Monitoring
• Input validation error in Oracle Access Manager
• Multiple vulnerabilities in Oracle Documaker
• Multiple vulnerabilities in IBM Application Performance Management
• IBM watsonx.data update for Logback, Guava and Apache HTTPClient
• IBM Sterling Connect:Direct Web Services update for Apache HttpClient
• Multiple vulnerabilities in Oracle Commerce Platform
• SUSE update for httpcomponents-client, httpcomponents-core
• Multiple vulnerabilities in IBM Analytics Content Hub
• Multiple vulnerabilities in Fuse 7
• IBM EntireX update for Apache HttpClient
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM TRIRIGA
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Anolis OS update for maven:3.6 module
• Anolis OS update for maven:3.5 module
• RSA Authentication Manager update for third-party components
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in HPE Telco Network Function Virtualization Orchestrator Software
• Multiple vulnerabilities in Oracle Essbase
• Input validation error in Siebel CRM Development
• Multiple vulnerabilities in IBM StreamSets Data Collector
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge