Update dependent httpclient library to address GHSA-hwvm-vfw8-93mw

Signed-off-by: Christopher Grote <chris@thegrotes.net>
odpi · Dec 16, 2021 · 7b2dcc9 · 7b2dcc9
1 parent e8eaa2e
commit 7b2dcc9
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -76,6 +76,7 @@
         <slf4j.version>1.7.32</slf4j.version>
         <logback.version>1.2.8</logback.version>
         <testng.version>7.4.0</testng.version>
+        <httpclient.version>4.5.13</httpclient.version>
         <!-- Platform encoding  -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
@@ -170,6 +171,13 @@
                 <version>${xtdb.version}</version>
                 <scope>runtime</scope>
             </dependency>
+            <!-- Following dependency is to ensure we use updated version of dependent library to avoid CVE-2020-13956 -->
+            <dependency>
+                <groupId>org.apache.httpcomponents</groupId>
+                <artifactId>httpclient</artifactId>
+                <version>${httpclient.version}</version>
+                <scope>runtime</scope>
+            </dependency>
             <dependency>
                 <groupId>com.xtdb</groupId>
                 <artifactId>xtdb-metrics</artifactId>