GHSA-HWVM-VFW8-93MW

Vulnerable dependency in XTDB connector

Workarounds

We have not investigated specific workarounds, but per the description of the issue it seems likely that ensuring the proper URIs are used for any S3 connectivity used by the connector (and ensuring there are appropriate controls around modifying such URIs in the connector's configuration) would be the first point of investigation.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-13956

The impacted portion of the XTDB connector is its connectivity to S3 as a backing store: this is the only portion of the connector that uses this vulnerable httpclient dependency. Per the description, the vulnerability regards URIs that may be misinterpreted, which given the area of impact within the connector we understand to be any URI used to configure connectivity to S3. Note therefore that if you do not use or configure S3 as a backing store in your use of the connector, you should not be exposed to any vulnerability from this component.

GHSA-HWVM-VFW8-93MW has a CVSS score of 5.3 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.5); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

The problem has been addressed in version 4.5.13 of the httpclient library, which is included as a replacement dependency version for the build of the XTDB connector from release 3.5 onwards. Therefore, using release 3.5 (or newer) of the connector will include the fixes to address this CVE.

1. What is GHSA-HWVM-VFW8-93MW? GHSA-HWVM-VFW8-93MW is a medium-severity security vulnerability in org.odpi.egeria:egeria-connector-xtdb (maven), affecting versions < 3.5. It is fixed in 3.5.
2. How severe is GHSA-HWVM-VFW8-93MW? GHSA-HWVM-VFW8-93MW has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of org.odpi.egeria:egeria-connector-xtdb are affected by GHSA-HWVM-VFW8-93MW? org.odpi.egeria:egeria-connector-xtdb (maven) versions < 3.5 is affected.
4. Is there a fix for GHSA-HWVM-VFW8-93MW? Yes. GHSA-HWVM-VFW8-93MW is fixed in 3.5. Upgrade to this version or later.
5. Is GHSA-HWVM-VFW8-93MW exploitable, and should I be worried? Whether GHSA-HWVM-VFW8-93MW is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-HWVM-VFW8-93MW is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-HWVM-VFW8-93MW? Upgrade org.odpi.egeria:egeria-connector-xtdb to 3.5 or later.