{"action":"Upgrade org.apache.httpcomponents:httpclient to 4.3.1 or later.","affected":[{"fixed":"4.3.1","introduced":"4.3"}],"component":"org.apache.httpcomponents:httpclient","cve_ids":["CVE-2013-4366"],"ecosystem":"Maven","epss":0.03309,"exploited":false,"fixed_versions":["4.3.1"],"ghsa_id":"GHSA-pqwh-44jj-p5rm","id":"tcs_01M5N97X6S44CC2E6TGQ4K2M86","modified_at":"2024-03-05T17:33:19.157465Z","published_at":"2022-05-13T01:25:03Z","references":["https://osv.dev/vulnerability/GHSA-pqwh-44jj-p5rm","https://nvd.nist.gov/vuln/detail/CVE-2013-4366","https://github.com/apache/httpcomponents-client/commit/08140864e3e4c0994e094c4cf0507932baf6a66","http://svn.apache.org/r1528614","http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pqwh-44jj-p5rm","url":"https://osv.dev/vulnerability/GHSA-pqwh-44jj-p5rm"}],"summary":"Hostname verification in Apache HttpClient 4.3 was disabled by default"}