GitHub Advisoryadvisory · PyPI
GHSA-6pc9-xqrg-wfqw Exposure of Sensitive information in httpie
MEDIUM
Official page ↗
- Aliases
- CVE-2022-0430
- Ecosystem
- PyPI
- Packages
- httpie
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2022-03-19
Affected packages
• PyPI httpie: < 3.1.0 → fixed in 3.1.0
Description
httpie is a modern, user-friendly command-line HTTP client for the API era. Prior to version 3.1.0, all cookies saved to session storage are supercookies. At this time, there is no known workaround. Users are recommended to update to version 3.1.0.
Related
Alias · CVE (1)
- CVE-2022-0430 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-0430 advisory
- https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b web
- https://github.com/advisories/GHSA-6pc9-xqrg-wfqw advisory
- https://github.com/httpie/httpie package
- https://github.com/pypa/advisory-database/tree/main/vulns/httpie/PYSEC-2022-167.yaml web
- https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f web