CVE-2022-24737
published 2022-03-07CVE-2022-24737: HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
1.63%
73.5th percentile
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | httpie | < httpie 3.2.1-1 (bookworm) | httpie 3.2.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| httpie | httpie | < 3.1.0 | 3.1.0 |
| httpie | httpie | >= 0 < 3.2.1-1 | 3.2.1-1 |
| httpie | httpie | >= 0 < 3.2.1-1 | 3.2.1-1 |
| httpie | httpie | >= 0 < 3.2.1-1 | 3.2.1-1 |
| httpie | httpie | >= 0 < 3.1.0 | 3.1.0 |
| httpie | httpie | >= 0 < 65ab7d5caaaf2f95e61f9dd65441801c2ddee38b | 65ab7d5caaaf2f95e61f9dd65441801c2ddee38b |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in httpie
ghsa·2022-03-07
CVE-2022-24737 [MEDIUM] CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in httpie
Exposure of Sensitive Information to an Unauthorized Actor in httpie
### Impact
HTTPie have the practical concept of [sessions](https://httpie.io/docs/cli/sessions), which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. As an example, we can make an authenticated request and save it to a [named session](https://httpie.io/docs/cli/named-sessions) called `api`:
```bash
$ http --session api -a user:pass pie.dev/basic-auth/user/pass
```
```json
{
"authenticated": true,
"user": "user"
}
```
Since we have now saved the authentication data to that session, we won‘t have to enter it again and again on every invocation. We can simply reference the session, and HTTPie will use the saved state directly
OSV
CVE-2022-24737: HTTPie is a command-line HTTP client
osv·2022-03-07·CVSS 6.5
CVE-2022-24737 [MEDIUM] CVE-2022-24737: HTTPie is a command-line HTTP client
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
OSV
Exposure of Sensitive Information to an Unauthorized Actor in httpie
osv·2022-03-07
CVE-2022-24737 [MEDIUM] Exposure of Sensitive Information to an Unauthorized Actor in httpie
Exposure of Sensitive Information to an Unauthorized Actor in httpie
### Impact
HTTPie have the practical concept of [sessions](https://httpie.io/docs/cli/sessions), which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. As an example, we can make an authenticated request and save it to a [named session](https://httpie.io/docs/cli/named-sessions) called `api`:
```bash
$ http --session api -a user:pass pie.dev/basic-auth/user/pass
```
```json
{
"authenticated": true,
"user": "user"
}
```
Since we have now saved the authentication data to that session, we won‘t have to enter it again and again on every invocation. We can simply reference the session, and HTTPie will use the saved state directly
OSV
CVE-2022-24737: HTTPie is a command-line HTTP client
osv·2022-03-07
CVE-2022-24737 CVE-2022-24737: HTTPie is a command-line HTTP client
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
Debian
CVE-2022-24737: httpie - HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessio...
vendor_debian·2022·CVSS 6.5
CVE-2022-24737 [MEDIUM] CVE-2022-24737: httpie - HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessio...
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
Scope: local
bookworm: resolved (fixed in 3.2.1-1)
bullseye: open
forky: resolved (fixed in 3.2.1-1)
sid: resolved (fixed in 3.2.1-1)
trixie: resolved (fixed in 3.2.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38bhttps://github.com/httpie/httpie/releases/tag/3.1.0https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fqhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY/https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38bhttps://github.com/httpie/httpie/releases/tag/3.1.0https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fqhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY/
2022-03-07
Published