The scope of this CVE affected version is [,4.5.13)
After further analysis, in this project, the main Api called is <org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>
<org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>
at <org.apache.http.impl.client.DecompressingHttpClient: org.apache.http.HttpHost getHttpHost(org.apache.http.client.methods.HttpUriRequest)> (org.apache.http.impl.client.DecompressingHttpClient.java:[137]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.jar
at <org.apache.http.impl.client.DecompressingHttpClient: org.apache.http.HttpResponse execute(org.apache.http.client.methods.HttpUriRequest)> (org.apache.http.impl.client.DecompressingHttpClient.java:[123]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.jar
at <com.mashape.unirest.http.HttpClientHelper: com.mashape.unirest.http.HttpResponse request(com.mashape.unirest.request.HttpRequest,java.lang.Class)> (com.mashape.unirest.http.HttpClientHelper.java:[138]) in /.m2/repository/com/mashape/unirest/unirest-java/1.4.9/unirest-java-1.4.9.jar
at <com.mashape.unirest.request.BaseRequest: com.mashape.unirest.http.HttpResponse asJson()> (com.mashape.unirest.request.BaseRequest.java:[68]) in /.m2/repository/com/mashape/unirest/unirest-java/1.4.9/unirest-java-1.4.9.jar
at <com.simplesteph.kafka.GitHubAPIHttpClient: com.mashape.unirest.http.HttpResponse getNextIssuesAPI(java.lang.Integer,java.time.Instant)> (com.simplesteph.kafka.GitHubAPIHttpClient.java:[84]) in /detect/unzip/kafka-connect-github-source-1.1/target/classes
Hi, In kafka-connect-github-source,there is a dependency org.apache.httpcomponents:httpclient:4.5.2 that calls the risk method.
CVE-2020-13956
The scope of this CVE affected version is [,4.5.13)
After further analysis, in this project, the main Api called is <org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>
Risk method repair link : GitHub
CVE Bug Invocation Path--
Path Length : 6
Dependency tree--
Suggested solutions:
Update dependency version to 4.5.13 or higher
Thank you very much.