File _patchinfo of Package patchinfo.36366

<patchinfo incident="36366">
  <issue tracker="bnc" id="1177488">VUL-0: CVE-2020-13956: apache-commons-httpclient,jakarta-commons-httpclient3: incorrect handling of malformed URI authority component</issue>
  <issue tracker="cve" id="2020-13956"/>
  <packager>fstrba</packager>
  <rating>moderate</rating>
  <category>security</category>
  <summary>Security update for httpcomponents-client, httpcomponents-core</summary>
  <description>This update for httpcomponents-client, httpcomponents-core fixes the following issues:

httpcomponents-client:
  - Update to version 4.5.14
    * HTTPCLIENT-2206: Corrected resource de-allocation by fluent
      response objects.
    * HTTPCLIENT-2174: URIBuilder to return a new empty list instead
      of unmodifiable Collections#emptyList.
    * Don't retry requests in case of NoRouteToHostException.
    * HTTPCLIENT-2144: RequestBuilder fails to correctly copy charset
      of requests with form url-encoded body.
    * PR #269: 4.5.x use array fill and more.
      + Use Arrays.fill().
      + Remove redundant modifiers.
      + Use Collections.addAll() and Collection.addAll() APIs instead of loops.
      + Remove redundant returns.
      + No need to explicitly declare an array when calling a vararg method.
      + Remote extra semicolons (;).
      + Use a 'L' instead of 'l' to make long literals more readable.
    * PublicSuffixListParser.parseByType(Reader) allocates but does
      not use a 256 char StringBuilder.
    * Incorrect handling of malformed authority component by
      URIUtils#extractHost (bsc#1177488, CVE-2020-13956).
    * Avoid updating Content-Length header in a 304 response.
    * Bug fix: BasicExpiresHandler is annotated as immutable but is
      not (#239)
    * HTTPCLIENT-2076: Fixed NPE in LaxExpiresHandler.

httpcomponents-core:
  - Upgraded to version 4.4.14
    * PR #231: 4.4.x Use better map apis and more.
      + Remove redundant modifiers.
      + Use Collections.addAll() API instead of loops.
      + Remove redundant returns.
      + No need to explicitly declare an array when calling a vararg method.
      + Remote extra semicolons (;).
    * Bug fix: Non-blocking TLSv1.3 connections can end up in an
      infinite event spin when closed concurrently by the local and
      the remote endpoints.
    * HTTPCORE-647: Non-blocking connection terminated due to
      'java.io.IOException: Broken pipe' can enter an infinite loop
      flushing buffered output data.
    * PR #201, HTTPCORE-634: Fix race condition in AbstractConnPool
      that can cause internal state corruption when persistent
      connections are manually removed from the pool.
</description>
</patchinfo>