tree f2f598327a6dbc7c4beba07737422f4e7d502ea8
parent 7144f711b41f5f671cb10f5b270b7f539e0c4db4
author Sachin Pattan <sachin.pattan@sap.com> 1603269878 +0200
committer GitHub <noreply@github.com> 1603269878 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJfj/T2CRBK7hj4Ov3rIwAAdHIIADsvCQtOfMw+qx3+BBV3PGXI
 GSlX7bT7eX8+OrZwdePXZ2GACqa0FBgiEiHivfjyroliKUztbfjjL1Ev6FEr0g3u
 x/Zyi5CNebLiTNggnWpQZzhYUfDUsruF3HDOB4Vx7/+RSyUeWTzQKBy++Sv2jtFx
 ypmUYWZ/1zu/ca0A5teEJMoHcHZkAr5B79+o5R3ZJy/SVYaxeaR6W1EjDBc/72Xq
 Gad+taT1pbVNMAruBiudvzlU3hXfY8dTSDgKZKvsLUtcBeuvswkK0+YT/uZoypXE
 +AY7wtA+pwFCR9JXdGheGXnqZ8t9OX1QJJTVhn/BrF4jDVfehsS2ADZG3f+msho=
 =OXkm
 -----END PGP SIGNATURE-----
 

CVE-2020-13956:Update httpclient.version to 4.5.13

As per https://bugzilla.redhat.com/show_bug.cgi?id=1886587, http.client librarires below version 4.5.13 have the vulnerability CVE-2020-13956. As Karaf rebundles http.client classes as seen at https://github.com/apache/karaf/blob/karaf-4.2.10/jaas/modules/pom.xml#L180 This makes it vulnerable and hence our security scans are detecting it as a vulnerable library. And hence updating the httpclient.version to 4.5.13.