fix vulnerabilties issue: commons-httpclient