Dependency org.apache.httpcomponents:httpclient, leading to CVE problem

Hi, In **/elasticsearchwriter**，there is a dependency **org.apache.httpcomponents:httpclient:jar:4.5.3
** that calls the risk method.

[CVE-2020-13956](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13956)

The scope of this CVE affected version is **[,4.5.13)**

After further analysis, in this project, the main Api called is **org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost**

Risk method repair link : [GitHub](https://github.com/apache/httpcomponents-client/commit/e628b4c5c464c2fa346385596cc78e035a91a62e)

**CVE Bug Invocation Path--**

**Path Length : 7**

```
com.alibaba.datax.plugin.writer.elasticsearchwriter.ElasticSearchClient: execute(io.searchbox.action.Action)Lio.searchbox.client.JestResult; /.m2/repository/commons-io/commons-io/2.4/commons-io-2.4.jar
io.searchbox.client.http.JestHttpClient: execute(io.searchbox.action.Action)Lio.searchbox.client.JestResult; /.m2/repository/org/apache/httpcomponents/httpcore/4.4.6/httpcore-4.4.6.jar
io.searchbox.client.http.JestHttpClient: execute(io.searchbox.action.Action,org.apache.http.client.config.RequestConfig)Lio.searchbox.client.JestResult; /.m2/repository/org/apache/httpcomponents/httpcore/4.4.6/httpcore-4.4.6.jar
io.searchbox.client.http.JestHttpClient: executeRequest(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.client.methods.CloseableHttpResponse; /.m2/repository/org/apache/httpcomponents/httpcore/4.4.6/httpcore-4.4.6.jar
org.apache.http.impl.client.CloseableHttpClient: execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.protocol.HttpContext)Lorg.apache.http.client.methods.CloseableHttpResponse; /.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
org.apache.http.impl.client.CloseableHttpClient: determineTarget(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.HttpHost; /.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost;

```
**Dependency tree--**

```
[INFO] com.alibaba.datax:elasticsearchwriter:jar:0.0.1-SNAPSHOT
[INFO] +- com.alibaba.datax:datax-common:jar:0.0.1-SNAPSHOT:compile
[INFO] | +- org.apache.commons:commons-lang3:jar:3.3.2:compile
[INFO] | +- com.alibaba:fastjson:jar:1.1.46.sec10:compile
[INFO] | +- commons-io:commons-io:jar:2.4:compile
[INFO] | \- org.apache.commons:commons-math3:jar:3.1.1:compile
[INFO] +- org.slf4j:slf4j-api:jar:1.7.10:compile
[INFO] +- ch.qos.logback:logback-classic:jar:1.0.13:compile
[INFO] | \- ch.qos.logback:logback-core:jar:1.0.13:compile
[INFO] +- io.searchbox:jest-common:jar:6.3.1:compile
[INFO] | +- com.google.guava:guava:jar:21.0:compile
[INFO] | \- com.google.code.gson:gson:jar:2.8.0:compile
[INFO] +- io.searchbox:jest:jar:6.3.1:compile
[INFO] | +- org.apache.httpcomponents:httpcore-nio:jar:4.4.6:compile
[INFO] | | \- org.apache.httpcomponents:httpcore:jar:4.4.6:compile
[INFO] | +- org.apache.httpcomponents:httpclient:jar:4.5.3:compile
[INFO] | | +- commons-logging:commons-logging:jar:1.2:compile
[INFO] | | \- commons-codec:commons-codec:jar:1.9:compile
[INFO] | \- org.apache.httpcomponents:httpasyncclient:jar:4.1.3:compile
[INFO] +- joda-time:joda-time:jar:2.9.7:compile
[INFO] +- junit:junit:jar:4.13.1:test
[INFO] \- org.hamcrest:hamcrest-core:jar:1.3:compile
```

**_Suggested solutions:_**

Update dependency version

Thank you very much.

In /elasticsearchwriter, inspect the Maven dependency declarations and the dependency tree for io.searchbox:jest and org.apache.httpcomponents:httpclient:4.5.3; review the reported URIUtils invocation and the linked Apache fix. Update the dependency to a version outside the affected range, then verify the dependency tree and project build no longer use the vulnerable version.

Written by the indexing model from the issue text.