Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1860 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1861 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Apache     Commons BCEL)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server     (CVE-2022-42920)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Maven Shared Utils)). The supported version that is affected is 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2022-29599)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2023-22069)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5239-1 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpcomponents-client installed on the remote host is prior to 4.2.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1946 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 19c and 21c versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning (Numpy) component of Oracle Database Server. The     supported version that is affected is 21c. Easily exploitable vulnerability allows low privileged attacker     having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Machine     Learning (Numpy). (CVE-2021-41495)  

  - Vulnerability in the Spatial and Graph (jackson-databind) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with network access via HTTP to compromise Spatial and     Graph (jackson-databind). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Spatial and Graph (jackson-databind).
    (CVE-2020-36518)

  - Vulnerability in the Oracle Notification Server (PCRE2) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Subscriber privilege with network access via HTTP to compromise Oracle Notification     Server (PCRE2). Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Notification Server (PCRE2).
    Note: This vulnerability applies to Windows systems only. (CVE-2022-1587)

  - Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported     version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having     DBA user privilege with network access via Oracle Net to compromise Oracle Database - Advanced Queuing.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Advanced Queuing.
    (CVE-2022-21596)

  - Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions     that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having     Local Logon privilege with network access via Local Logon to compromise Oracle Database - Sharding.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Sharding.
    (CVE-2022-21603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1860 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1861 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1861 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1860 advisory.

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority     component in request URIs passed to the library as java.net.URI object and pick the wrong target host for     request execution. (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1861 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1860 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1860 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:1861 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0722 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic     Server. (CVE-2022-21306)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web     Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base     Score 7.5 (Confidentiality impacts). (CVE-2022-21371)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle WebLogic Server accessible data. (CVE-2022-21292)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in Oracle NoSQL Database (component: Administration (Node.js)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle NoSQL Database.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. (CVE-2021-22883)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (jackson-databind)).
    This vulnerability cannot be exploited in the context of this product. (CVE-2019-14379)

  - Vulnerability in Oracle NoSQL Database (component: Administration (Google Guava)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise     Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle NoSQL Database accessible data. (CVE-2020-8908)   
  - Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version     that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle NoSQL Database. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle NoSQL Database. (CVE-2020-11612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote host is 16.x prior to 16.2.16.5 or 17.x prior to 17.12.11.7 or 18.8.x prior to 18.8.18.4 or 19.12.x prior to 19.12.14 or 20.12.x prior to 20.12.4. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core UI     (jQuery)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks require human interaction from a person other than the attacker     and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some     of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier     accessible data. (CVE-2020-11022)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core (HTTP     Client)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Primavera Unifier accessible data. (CVE-2020-13956)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Groovy)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8, 19.12 and 20.12.
    Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where     Primavera Unifier executes to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data.
    (CVE-2020-17521)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Apache Maven project reports :

We received a report from Jonathan Leitschuh about a vulnerability of custom repositories in dependency POMs. We've split this up into three separate issues :

- Possible Man-In-The-Middle-Attack due to custom repositories using HTTP.

More and more repositories use HTTPS nowadays, but this hasn't always been the case. This means that Maven Central contains POMs with custom repositories that refer to a URL over HTTP. This makes downloads via such repository a target for a MITM attack. At the same time, developers are probably not aware that for some downloads an insecure URL is being used. Because uploaded POMs to Maven Central are immutable, a change for Maven was required. To solve this, we extended the mirror configuration with blocked parameter, and we added a new external:http:* mirror selector (like existing external:*), meaning 'any external URL using HTTP'.

The decision was made to block such external HTTP repositories by default : this is done by providing a mirror in the conf/settings.xml blocking insecure HTTP external URLs.

- Possible Domain Hijacking due to custom repositories using abandoned domains

Sonatype has analyzed which domains were abandoned and has claimed these domains.

- Possible hijacking of downloads by redirecting to custom repositories

This one was the hardest to analyze and explain. The short story is :
you're safe, dependencies are only downloaded from repositories within their context. So there are two main questions: what is the context and what is the order? The order is described on the Repository Order page. The first group of repositories are defined in the settings.xml (both user and global). The second group of repositories are based on inheritence, with ultimately the super POM containing the URL to Maven Central. The third group is the most complex one but is important to understand the term context: repositories from the effective POMs from the dependency path to the artifact. So if a dependency was defined by another dependency or by a Maven project, it will also include their repositories. In the end this is not a bug, but a design feature.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0246 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

  - wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-     controller (CVE-2020-25689)

  - undertow: special character in query results in server errors (CVE-2020-27782)

  - wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0248 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

  - wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-     controller (CVE-2020-25689)

  - undertow: special character in query results in server errors (CVE-2020-27782)

  - wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0247 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

  - wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-     controller (CVE-2020-25689)

  - undertow: special character in query results in server errors (CVE-2020-27782)

  - wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Priyank Nigam discovered that HttpComponents Client, a Java HTTP agent implementation, could misinterpret malformed authority component in a request URI and pick the wrong target host for request execution.

Oleg Kalnichevski discovered that httpcomponents-client, a Java library for building HTTP-aware applications, can misinterpret a malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

For Debian 9 stretch, this problem has been fixed in version 4.5.2-2+deb9u1.

We recommend that you upgrade your httpcomponents-client packages.

For the detailed security status of httpcomponents-client please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/httpcomponents-client

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184735	Rocky Linux 8 : maven:3.6 (RLSA-2022:1860)	Nessus	Rocky Linux Local Security Checks	medium
184615	Rocky Linux 8 : maven:3.5 (RLSA-2022:1861)	Nessus	Rocky Linux Local Security Checks	medium
183311	Oracle WebLogic Server (October 2023 CPU)	Nessus	Misc.	critical
183117	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : HttpClient vulnerability (USN-5239-1)	Nessus	Ubuntu Local Security Checks	medium
171804	Amazon Linux 2 : httpcomponents-client (ALAS-2023-1946)	Nessus	Amazon Linux Local Security Checks	medium
166370	Oracle Database Server (Oct 2022 CPU)	Nessus	Databases	critical
161321	Oracle Linux 8 : maven:3.6 (ELSA-2022-1860)	Nessus	Oracle Linux Local Security Checks	medium
161296	Oracle Linux 8 : maven:3.5 (ELSA-2022-1861)	Nessus	Oracle Linux Local Security Checks	medium
161099	AlmaLinux 8 : maven:3.5 (ALSA-2022:1861)	Nessus	Alma Linux Local Security Checks	medium
161090	AlmaLinux 8 : maven:3.6 (ALSA-2022:1860)	Nessus	Alma Linux Local Security Checks	medium
161018	RHEL 8 : maven:3.5 (RHSA-2022:1861)	Nessus	Red Hat Local Security Checks	medium
161010	RHEL 8 : maven:3.6 (RHSA-2022:1860)	Nessus	Red Hat Local Security Checks	medium
160969	CentOS 8 : maven:3.6 (CESA-2022:1860)	Nessus	CentOS Local Security Checks	medium
160900	CentOS 8 : maven:3.5 (CESA-2022:1861)	Nessus	CentOS Local Security Checks	medium
158556	RHEL 7 : rh-maven36-httpcomponents-client (RHSA-2022:0722)	Nessus	Red Hat Local Security Checks	medium
157127	Oracle WebLogic Server (Jan 2022 CPU)	Nessus	Misc.	critical
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	critical
148977	Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	critical
148918	Oracle Primavera Unifier (Apr 2021 CPU)	Nessus	CGI abuses	medium
148748	FreeBSD : Apache Maven -- multiple vulnerabilities (20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a)	Nessus	FreeBSD Local Security Checks	critical
145408	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0246)	Nessus	Red Hat Local Security Checks	medium
145407	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0248)	Nessus	Red Hat Local Security Checks	medium
145405	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0247)	Nessus	Red Hat Local Security Checks	medium
141464	Debian DSA-4772-1 : httpcomponents-client - security update	Nessus	Debian Local Security Checks	medium
141389	Debian DLA-2405-1 : httpcomponents-client security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-13956

medium

Tenable Plugins

medium

medium

critical

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical

medium

critical

medium

medium

medium

medium

medium