CVE-2020-13956
MediumAdvisory
Published 3 Jun 2021In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.090
- 95th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 190
- of 17,781 indexed, latest versions
- Container images
- 217
- deployed by those charts
- Fix available
- 28 of 28
- affected packages
Cross-site scripting in Apache HttpClient
Carried by container images the latest versions of 190 of 17,781 indexed charts deploy, on 217 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| httpclientmaven | 4.0.1, 4.0.2, 4.2.5, 4.2.6+19 more | 4.5.13 | 217 |
| aopalliancerpm | 1.0-20.module+el8.3.0+6804+157bd82e | 0:1.0-20.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-clirpm | 1.4-7.module+el8.3.0+6804+157bd82e | 0:1.4-7.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-codecrpm | 1.13-3.module+el8.3.0+6804+157bd82e | 0:1.13-3.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-iorpm | 1:2.6-6.module+el8.3.0+6804+157bd82e | 1:2.6-6.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-lang3rpm | 3.9-4.module+el8.3.0+6804+157bd82e | 0:3.9-4.module+el8.6.0+13337+afcb49ec | 5 |
| atinjectrpm | 1-31.20100611svn86.module+el8.3.0+6804+157bd82e | 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec | 5 |
| cdi-apirpm | 2.0.1-3.module+el8.3.0+6804+157bd82e | 0:2.0.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| geronimo-annotationrpm | 1.0-26.module+el8.3.0+6804+157bd82e | 0:1.0-26.module+el8.6.0+13337+afcb49ec | 5 |
| google-guicerpm | 4.2.2-4.module+el8.3.0+6804+157bd82e | 0:4.2.2-4.module+el8.6.0+13337+afcb49ec | 5 |
| guavarpm | 28.1-3.module+el8.3.0+6804+157bd82e | 0:28.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-clientrpm | 4.5.10-3.module+el8.3.0+6804+157bd82e | 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-corerpm | 4.4.12-3.module+el8.3.0+6804+157bd82e | 0:4.4.12-3.module+el8.6.0+13337+afcb49ec | 5 |
| jansirpm | 1.18-4.module+el8.3.0+6804+157bd82e | 0:1.18-4.module+el8.6.0+13337+afcb49ec | 5 |
| jsouprpm | 1.12.1-3.module+el8.3.0+6804+157bd82e | 0:1.12.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| jsr-305rpm | 0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | 5 |
| mavenrpm | 1:3.6.2-6.module+el8.4.0+9250+1786af37 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | 5 |
| maven-resolverrpm | 1.4.1-3.module+el8.3.0+6804+157bd82e | 0:1.4.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| maven-shared-utilsrpm | 3.2.1-0.4.module+el8.3.0+6804+157bd82e | 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec | 5 |
| maven-wagonrpm | 3.3.4-2.module+el8.3.0+6804+157bd82e | 0:3.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-cipherrpm | 1.7-17.module+el8.3.0+6804+157bd82e | 0:1.7-17.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-classworldsrpm | 2.6.0-4.module+el8.3.0+6804+157bd82e | 0:2.6.0-4.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-containersrpm | 2.1.0-2.module+el8.3.0+6804+157bd82e | 0:2.1.0-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-interpolationrpm | 1.26-3.module+el8.3.0+6804+157bd82e | 0:1.26-3.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-sec-dispatcherrpm | 1.4-29.module+el8.3.0+6804+157bd82e | 0:1.4-29.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-utilsrpm | 3.3.0-3.module+el8.3.0+6804+157bd82e | 0:3.3.0-3.module+el8.6.0+13337+afcb49ec | 5 |
| sisurpm | 0.3.4-2.module+el8.3.0+6804+157bd82e | 0:0.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| slf4jrpm | 1.7.28-3.module+el8.3.0+6804+157bd82e | 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 5 |
- OSV records
- GHSA-7r82-7xv7-xcpjRHSA-2022:1860
Charts affected
190 by stars
Container images carrying it
217 by charts deploying them
A fixed version is listed for 28 of the 28 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opensearchproject/ | 43b0cdaf26ed | httpclient | 4.5.13 | 1 |
| openwhisk/ | f5831ec85525 | httpclient | 4.5.13 | 1 |
| openzipkin/ | b5d51d1144e2 | httpclient | 4.5.13 | 1 |
| owasp/ | efc65e702ee1 | httpclient | 4.5.13 | 1 |
| pedrocesarti/ | 14851f144f57 | httpclient | 4.5.13 | 1 |
| penpotapp/ | 5c835ffd87ab | httpclient | 4.5.13 | 1 |
| polyakov/ | dbcef69146b8 | httpclient | 4.5.13 | 1 |
| prom/ | 923705b2ae77 | httpclient | 4.5.13 | 1 |
| prom/ | fc4b9b9f5e15 | httpclient | 4.5.13 | 1 |
| raykrueger/ | c8baf3de57bb | httpclient | 4.5.13 | 1 |
| refar/ | 241373fa2972 | httpclient | 4.5.13 | 1 |
| refar/ | e5490f050f9f | httpclient | 4.5.13 | 1 |
| reportportal/ | 9df41f8fb320 | httpclient | 4.5.13 | 1 |
| reportportal/ | 9e73114dbd15 | httpclient | 4.5.13 | 1 |
| richardchesterwood/ | 518f946b9f05 | httpclient | 4.5.13 | 1 |
| robotshop/ | 89753ab48919 | httpclient | 4.5.13 | 1 |
| rodolpheche/ | 2328a9fce2bf | httpclient | 4.5.13 | 1 |
| rundeck/ | 4d64fe56f767 | httpclient | 4.5.13 | 1 |
| rundeck/ | b13e8059ad72 | httpclient | 4.5.13 | 1 |
| seldonio/ | ba81b17f00eb | httpclient | 4.5.13 | 1 |
| seldonio/ | eea0d3f578ca | httpclient | 4.5.13 | 1 |
| slamdev/ | b4b029c9b15f | httpclient | 4.5.13 | 1 |
| snappydatainc/ | fd4b2070466f | httpclient | 4.5.13 | 1 |
| snowplow/ | 41d318841516 | httpclient | 4.5.13 | 1 |
| sslhep/ | 9e80af083079 | httpclient | 4.5.13 | 1 |
| thehiveproject/ | f4bc64fb8844 | httpclient | 4.5.13 | 1 |
| thelastpickle/ | 9c53996c457d | httpclient | 4.5.13 | 1 |
| trinodb/ | ee80ab5eeab2 | httpclient | 4.5.13 | 1 |
| viniciusfcf/ | bba8ee1b5cd5 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpclient httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 4.5.13 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| voltha/ | e038acb950d3 | httpclient | 4.5.13 | 1 |
| vromero/ | 408d6a46b153 | httpclient | 4.5.13 | 1 |
| wavefronthq/ | d1064d28f6eb | httpclient | 4.5.13 | 1 |
| wistefan/ | e0887302b2d8 | httpclient | 4.5.13 | 1 |
| woojoong/ | ec230db19652 | httpclient | 4.5.13 | 1 |
| xetusoss/ | 88f25242b9ee | httpclient | 4.5.13 | 1 |
| zahoriaut/ | 351f8a220ed7 | httpclient | 4.5.13 | 1 |
| zammad/ | 8274d75a51fc | httpclient | 4.5.13 | 1 |
| zenko/ | 386a1f48ec0e | httpclient | 4.5.13 | 1 |
| gcr.io/ | 0ee5f968d2ab | httpclient | 4.5.13 | 1 |
| ghcr.io/ | aa45adaf59a7 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 8f4345c77dda | httpclient | 4.5.13 | 1 |
| ghcr.io/ | cf85570b1324 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 3be878690629 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | f1629ac5f9ec | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 415323ef112b | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 6fe372e4e481 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | c4c52955814f | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 8caf5289fe73 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 4b22b4f407c4 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | baa4fa9549dc | httpclient | 4.5.13 | 1 |