Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Red Hat Maven HTTP client may let attackers run code
published 2 years ago
Summary
The Maven HTTP client libraries provided by Red Hat can be tricked into executing code from a malicious server. This could let an attacker run unwanted programs on any system that uses these libraries. Apply the latest Red Hat update for rh-maven36-httpcomponents-client and its Javadoc to close the risk.
What to do
- Update redhat rh-maven36-httpcomponents-client to version 0:4.5.9-1.3.el7.
- Update redhat rh-maven36-httpcomponents-client-javadoc to version 0:4.5.9-1.3.el7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_software_collections:3::el7 | redhat | rh-maven36-httpcomponents-client |
< 0:4.5.9-1.3.el7 Fix: upgrade to 0:4.5.9-1.3.el7
|
| Red Hat:rhel_software_collections:3::el7 | redhat | rh-maven36-httpcomponents-client-javadoc |
< 0:4.5.9-1.3.el7 Fix: upgrade to 0:4.5.9-1.3.el7
|
Original advisory text
Red Hat Security Advisory: rh-maven36-httpcomponents-client security update
References
- https://access.redhat.com/errata/RHSA-2022:0722 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1886587 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0722.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2020-13956 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-13956 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-13956 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2020/10/08/4 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published1 Oct 2024
Updated2 Oct 2026
First seen2 Oct 2026
Sources
RHSA-2022:0722 · OSV
Track software like this
Free during beta