Security issue in dependency
schubon opened this issue · 1 comments
schubon commented
Dependency http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Remediation:
Upgrade org.apache.httpcomponents:httpclient to version 4.3.6 or later. For example:
org.apache.httpcomponents httpclient [4.3.6,)