Dependency org.apache.httpcomponents:httpclient, leading to CVE problem

[CVEDetect]

Hi, In services/pseudo_controller/，there is a dependency org.apache.httpcomponents:httpclient:4.5.5 that calls the risk method.

CVE-2020-13956

The scope of this CVE affected version is [,4.5.13)

After further analysis, in this project, the main Api called is org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 5

org.hucompute.textimager.uima.docker.DockerAPI: main(java.lang.String[])V .m2/repository/org/ow2/asm/asm-commons/5.0.3/asm-commons-5.0.3.jar
com.amihaiemil.docker.RtContainers: create(java.lang.String,javax.json.JsonObject)Lcom.amihaiemil.docker.Container; .m2/repository/org/ow2/asm/asm-commons/5.0.3/asm-commons-5.0.3.jar
org.apache.http.impl.client.DecompressingHttpClient: execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.client.ResponseHandler)Ljava.lang.Object; .m2/repository/org/ow2/asm/asm-commons/5.0.3/asm-commons-5.0.3.jar
org.apache.http.impl.client.DecompressingHttpClient: getHttpHost(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.HttpHost; .m2/repository/org/ow2/asm/asm-commons/5.0.3/asm-commons-5.0.3.jar
org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost;

Dependency tree--

[INFO] org.hucompute.textimager.uima:textimager-uima-docker:jar:0.3.0
[INFO] +- com.amihaiemil.web:docker-java-api:jar:0.0.13:compile
[INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.5:compile
[INFO] |  |  +- org.apache.httpcomponents:httpcore:jar:4.4.9:compile
[INFO] |  |  +- commons-logging:commons-logging:jar:1.2:compile
[INFO] |  |  \- commons-codec:commons-codec:jar:1.12:compile
[INFO] |  \- com.github.jnr:jnr-unixsocket:jar:0.18:compile
[INFO] |     +- com.github.jnr:jnr-ffi:jar:2.1.4:compile
[INFO] |     |  +- com.github.jnr:jffi:jar:1.2.15:compile
[INFO] |     |  +- com.github.jnr:jffi:jar:native:1.2.15:runtime
[INFO] |     |  +- org.ow2.asm:asm:jar:5.0.3:compile
[INFO] |     |  +- org.ow2.asm:asm-commons:jar:5.0.3:compile
[INFO] |     |  +- org.ow2.asm:asm-analysis:jar:5.0.3:compile
[INFO] |     |  +- org.ow2.asm:asm-tree:jar:5.0.3:compile
[INFO] |     |  +- org.ow2.asm:asm-util:jar:5.0.3:compile
[INFO] |     |  \- com.github.jnr:jnr-x86asm:jar:1.0.2:compile
[INFO] |     +- com.github.jnr:jnr-constants:jar:0.9.8:compile
[INFO] |     +- com.github.jnr:jnr-enxio:jar:0.16:compile
[INFO] |     \- com.github.jnr:jnr-posix:jar:3.0.35:compile
[INFO] +- org.glassfish:javax.json:jar:1.0.4:compile
[INFO] +- org.apache.logging.log4j:log4j-core:jar:2.17.1:compile
[INFO] |  \- org.apache.logging.log4j:log4j-api:jar:2.17.1:compile
[INFO] +- org.apache.uima:uimaj-core:jar:2.10.3:compile
[INFO] |  +- javax.xml.bind:jaxb-api:jar:2.3.1:runtime
[INFO] |  |  \- javax.activation:javax.activation-api:jar:1.2.0:runtime
[INFO] |  +- com.sun.xml.bind:jaxb-core:jar:2.3.0.1:runtime
[INFO] |  +- com.sun.xml.bind:jaxb-impl:jar:2.3.2:runtime
[INFO] |  \- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] +- org.apache.uima:uimafit-core:jar:2.4.0:compile
[INFO] |  +- commons-lang:commons-lang:jar:2.6:compile
[INFO] |  +- commons-io:commons-io:jar:2.6:compile
[INFO] |  +- commons-logging:commons-logging-api:jar:1.1:compile
[INFO] |  +- org.springframework:spring-core:jar:3.2.16.RELEASE:compile
[INFO] |  +- org.springframework:spring-context:jar:3.2.16.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-aop:jar:3.2.16.RELEASE:compile
[INFO] |  |  |  \- aopalliance:aopalliance:jar:1.0:compile
[INFO] |  |  \- org.springframework:spring-expression:jar:3.2.16.RELEASE:compile
[INFO] |  \- org.springframework:spring-beans:jar:3.2.16.RELEASE:compile
[INFO] \- org.dkpro.core:dkpro-core-testing-asl:jar:1.12.0:test
[INFO]    +- org.apache.commons:commons-lang3:jar:3.9:test
[INFO]    +- org.dkpro.core:dkpro-core-api-anomaly-asl:jar:1.12.0:test
[INFO]    +- org.dkpro.core:dkpro-core-api-coref-asl:jar:1.12.0:test
[INFO]    +- org.dkpro.core:dkpro-core-api-lexmorph-asl:jar:1.12.0:test
[INFO]    +- org.dkpro.core:dkpro-core-api-metadata-asl:jar:1.12.0:test
[INFO]    |  \- org.apache.uima:uimaj-document-annotation:jar:2.10.3:test
[INFO]    +- org.dkpro.core:dkpro-core-api-resources-asl:jar:1.12.0:test
[INFO]    |  +- org.apache.commons:commons-compress:jar:1.19:test
[INFO]    |  +- org.apache.maven:maven-model:jar:3.0.5:test
[INFO]    |  +- org.apache.ivy:ivy:jar:2.4.0:test
[INFO]    |  +- org.codehaus.plexus:plexus-utils:jar:2.0.6:test
[INFO]    |  \- org.tukaani:xz:jar:1.8:test
[INFO]    +- org.dkpro.core:dkpro-core-api-segmentation-asl:jar:1.12.0:test
[INFO]    |  \- eu.openminted.share.annotations:omtd-share-annotations-api:jar:3.0.2.7:test
[INFO]    +- org.dkpro.core:dkpro-core-api-syntax-asl:jar:1.12.0:test
[INFO]    +- org.dkpro.core:dkpro-core-api-semantics-asl:jar:1.12.0:test
[INFO]    +- org.dkpro.core:dkpro-core-api-ner-asl:jar:1.12.0:test
[INFO]    +- org.dkpro.core:dkpro-core-api-parameter-asl:jar:1.12.0:test
[INFO]    +- org.reflections:reflections:jar:0.9.10:test
[INFO]    |  +- com.google.guava:guava:jar:15.0:test
[INFO]    |  +- org.javassist:javassist:jar:3.19.0-GA:test
[INFO]    |  \- com.google.code.findbugs:annotations:jar:2.0.1:test
[INFO]    \- junit:junit:jar:4.12:test
[INFO]       \- org.hamcrest:hamcrest-core:jar:1.3:test

Suggested solutions:

Update dependency version

Thank you very much.