CVE-2022-24737
Medium
Description
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Httpie
PublishedMar 7, 2022
First seenMar 7, 2022
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- httpie httpie3.1.0 or later
- httpie3.1.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| httpie httpie | v < 3.1.0 | 3.1.0 |
| fedoraproject fedora | 34, 35, 36 | — |
| httpiePyPI | v < 3.1.0 | 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.