Dependency org.apache.httpcomponents:httpclient, leading to CVE problem

[CVEDetect]

Hi, In deegree3-deegree/deegree-core/deegree-core-commons，there is a dependency org.apache.httpcomponents:httpclient:4.3.6 that calls the risk method.

CVE-2020-13956

The scope of this CVE affected version is [,4.5.13)

After further analysis, in this project, the main Api called is <org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 5

<org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>
at <org.apache.http.impl.client.CloseableHttpClient: org.apache.http.HttpHost determineTarget(org.apache.http.client.methods.HttpUriRequest)> (org.apache.http.impl.client.CloseableHttpClient.java:[92]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.3.6/httpclient-4.3.6.jar
at <org.apache.http.impl.client.CloseableHttpClient: org.apache.http.client.methods.CloseableHttpResponse execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.protocol.HttpContext)> (org.apache.http.impl.client.CloseableHttpClient.java:[82]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.3.6/httpclient-4.3.6.jar
at <org.apache.http.impl.client.CloseableHttpClient: org.apache.http.client.methods.CloseableHttpResponse execute(org.apache.http.client.methods.HttpUriRequest)> (org.apache.http.impl.client.CloseableHttpClient.java:[106]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.3.6/httpclient-4.3.6.jar
at <org.deegree.commons.utils.net.HttpUtils: org.deegree.commons.utils.Pair postFullResponse(org.deegree.commons.utils.net.HttpUtils$Worker,java.lang.String,java.util.Map,java.util.Map,int)> (org.deegree.commons.utils.net.HttpUtils.java:[343]) in /detect/unzip/deegree3-deegree-3.4.16/deegree-core/deegree-core-commons/target/classes

Dependency tree--

[INFO] org.deegree:deegree-core-commons:jar:3.4.16
[INFO] +- org.deegree:deegree-core-workspace:jar:3.4.16:compile
[INFO] |  \- org.deegree:deegree-core-annotations:jar:3.4.16:compile
[INFO] |     +- log4j:log4j:jar:1.2.17:compile
[INFO] |     +- org.slf4j:slf4j-api:jar:1.7.13:compile
[INFO] |     +- org.slf4j:slf4j-log4j12:jar:1.7.13:compile
[INFO] |     +- org.slf4j:jcl-over-slf4j:jar:1.7.13:compile
[INFO] |     \- commons-io:commons-io:jar:2.4:compile
[INFO] +- org.codehaus.woodstox:woodstox-core-lgpl:jar:4.2.0:compile
[INFO] |  \- org.codehaus.woodstox:stax2-api:jar:3.1.1:compile
[INFO] +- org.apache.ws.commons.axiom:axiom-impl:jar:1.2.15:compile
[INFO] +- org.apache.ws.commons.axiom:axiom-api:jar:1.2.15:compile
[INFO] |  +- org.apache.geronimo.specs:geronimo-activation_1.1_spec:jar:1.1:compile
[INFO] |  +- org.apache.geronimo.specs:geronimo-stax-api_1.0_spec:jar:1.0.1:compile
[INFO] |  \- org.apache.james:apache-mime4j-core:jar:0.7.2:compile
[INFO] +- com.sun.xml.fastinfoset:FastInfoset:jar:1.2.13:compile
[INFO] +- javax.mail:mail:jar:1.4.7:provided
[INFO] |  \- javax.activation:activation:jar:1.1.1:provided
[INFO] +- jaxen:jaxen:jar:1.1.6:compile
[INFO] +- xerces:xercesImpl:jar:2.12.0:compile
[INFO] |  \- xml-apis:xml-apis:jar:1.4.01:compile
[INFO] +- net.sf.saxon:Saxon-HE:jar:9.9.1-4:compile
[INFO] +- commons-dbcp:commons-dbcp:jar:1.4:compile
[INFO] +- org.apache.httpcomponents:httpclient:jar:4.3.6:compile
[INFO] |  +- org.apache.httpcomponents:httpcore:jar:4.3.3:compile
[INFO] |  \- commons-codec:commons-codec:jar:1.7:compile
[INFO] +- commons-pool:commons-pool:jar:1.6:compile
[INFO] +- jogl:jogl:jar:1.1.2:compile
[INFO] +- commons-cli:commons-cli:jar:1.2:compile
[INFO] +- org.reflections:reflections:jar:0.9.11:compile
[INFO] |  +- com.google.guava:guava:jar:20.0:compile
[INFO] |  \- org.javassist:javassist:jar:3.20.0-GA:compile
[INFO] +- com.google.code.gson:gson:jar:2.2.2:compile
[INFO] +- org.deegree:deegree-ogcschemas:jar:20191108:compile

Suggested solutions:

Update dependency version

Thank you very much.

[CVEDetect]

@tfr42
Could please help me check this issue?
May I pull a request to fix it?
Thanks again.

[tfr42]

Relates to #1197

[tfr42]

PR #1148 merged