CVE-2020-13956
MediumAdvisory
Published 3 Jun 2021In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.090
- 95th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 190
- of 17,781 indexed, latest versions
- Container images
- 217
- deployed by those charts
- Fix available
- 28 of 28
- affected packages
Cross-site scripting in Apache HttpClient
Carried by container images the latest versions of 190 of 17,781 indexed charts deploy, on 217 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| httpclientmaven | 4.0.1, 4.0.2, 4.2.5, 4.2.6+19 more | 4.5.13 | 217 |
| aopalliancerpm | 1.0-20.module+el8.3.0+6804+157bd82e | 0:1.0-20.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-clirpm | 1.4-7.module+el8.3.0+6804+157bd82e | 0:1.4-7.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-codecrpm | 1.13-3.module+el8.3.0+6804+157bd82e | 0:1.13-3.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-iorpm | 1:2.6-6.module+el8.3.0+6804+157bd82e | 1:2.6-6.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-lang3rpm | 3.9-4.module+el8.3.0+6804+157bd82e | 0:3.9-4.module+el8.6.0+13337+afcb49ec | 5 |
| atinjectrpm | 1-31.20100611svn86.module+el8.3.0+6804+157bd82e | 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec | 5 |
| cdi-apirpm | 2.0.1-3.module+el8.3.0+6804+157bd82e | 0:2.0.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| geronimo-annotationrpm | 1.0-26.module+el8.3.0+6804+157bd82e | 0:1.0-26.module+el8.6.0+13337+afcb49ec | 5 |
| google-guicerpm | 4.2.2-4.module+el8.3.0+6804+157bd82e | 0:4.2.2-4.module+el8.6.0+13337+afcb49ec | 5 |
| guavarpm | 28.1-3.module+el8.3.0+6804+157bd82e | 0:28.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-clientrpm | 4.5.10-3.module+el8.3.0+6804+157bd82e | 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-corerpm | 4.4.12-3.module+el8.3.0+6804+157bd82e | 0:4.4.12-3.module+el8.6.0+13337+afcb49ec | 5 |
| jansirpm | 1.18-4.module+el8.3.0+6804+157bd82e | 0:1.18-4.module+el8.6.0+13337+afcb49ec | 5 |
| jsouprpm | 1.12.1-3.module+el8.3.0+6804+157bd82e | 0:1.12.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| jsr-305rpm | 0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | 5 |
| mavenrpm | 1:3.6.2-6.module+el8.4.0+9250+1786af37 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | 5 |
| maven-resolverrpm | 1.4.1-3.module+el8.3.0+6804+157bd82e | 0:1.4.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| maven-shared-utilsrpm | 3.2.1-0.4.module+el8.3.0+6804+157bd82e | 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec | 5 |
| maven-wagonrpm | 3.3.4-2.module+el8.3.0+6804+157bd82e | 0:3.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-cipherrpm | 1.7-17.module+el8.3.0+6804+157bd82e | 0:1.7-17.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-classworldsrpm | 2.6.0-4.module+el8.3.0+6804+157bd82e | 0:2.6.0-4.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-containersrpm | 2.1.0-2.module+el8.3.0+6804+157bd82e | 0:2.1.0-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-interpolationrpm | 1.26-3.module+el8.3.0+6804+157bd82e | 0:1.26-3.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-sec-dispatcherrpm | 1.4-29.module+el8.3.0+6804+157bd82e | 0:1.4-29.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-utilsrpm | 3.3.0-3.module+el8.3.0+6804+157bd82e | 0:3.3.0-3.module+el8.6.0+13337+afcb49ec | 5 |
| sisurpm | 0.3.4-2.module+el8.3.0+6804+157bd82e | 0:0.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| slf4jrpm | 1.7.28-3.module+el8.3.0+6804+157bd82e | 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 5 |
- OSV records
- GHSA-7r82-7xv7-xcpjRHSA-2022:1860
Charts affected
190 by stars
Container images carrying it
217 by charts deploying them
A fixed version is listed for 28 of the 28 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | b2de2ff6e8e0 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | d46ce7b96482 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 821fd6a6f2cd | httpclient | 4.5.13 | 1 |
| ghcr.io/ | b83b5b81d4b6 | httpclient | 4.5.13 | 1 |
| ghcr.io/ | 7525a57ac3f1 | httpclient | 4.5.13 | 1 |
| public.ecr.aws/ | 43316f900242 | httpclient | 4.5.13 | 1 |
| public.ecr.aws/ | 75f00caa6f3f | httpclient | 4.5.13 | 1 |
| public.ecr.aws/ | 8cdcb7e83f9f | httpclient | 4.5.13 | 1 |
| quay.io/ | a3b9a07648b6 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpclient httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 4.5.13 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | 55330b1b60c1 | httpclient | 4.5.13 | 1 |
| quay.io/ | bb40472e4ff5 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpclient httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 4.5.13 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | 0dc38a87b844 | httpclient | 4.5.13 | 1 |
| quay.io/ | a8a9ec461034 | httpclient | 4.5.13 | 1 |
| quay.io/ | 93889c3d8a34 | httpclient | 4.5.13 | 1 |
| quay.io/ | e383ba3e0966 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpclient httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 4.5.13 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | 98c26e1b8f70 | httpclient | 4.5.13 | 1 |
| quay.io/ | 8e928db29ee1 | httpclient | 4.5.13 | 1 |