Sensitive Information Exposure in httpie: CVE-2022-0430
Summary
CVE-2022-0430: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0. Affects httpie across 2 version ranges.
< 65ab7d5caaaf2f95e61f9dd65441801c2ddee38b
< 266c6375c6d687c3aad07962cb3f5bef7d39bbbf
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
httpie is a command-line HTTP client designed for making API requests easier to use and understand. It provides a user-friendly interface and supports various features like JSON formatting, syntax highlighting, and session persistence. However, prior to version 3.1.0, httpie had a vulnerability that allowed unauthorized actors to access sensitive information.
Vulnerability Detail
CVE-2022-0430 is a vulnerability that exposes sensitive information to unauthorized actors in the httpie package. This issue arises from improper handling of sensitive data, which can lead to information leakage. The vulnerability affects multiple versions of httpie across different Debian ecosystems, allowing attackers to potentially gain access to confidential information that could be exploited for malicious purposes. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, users can mitigate the risk by ensuring that sensitive information is not logged or exposed in any way. This includes reviewing configuration files and ensuring that no sensitive data is included in HTTP requests or responses.
Conclusion
CVE-2022-0430 is a significant vulnerability in the httpie package that exposes sensitive information to unauthorized actors. Users are strongly advised to upgrade to the latest version to mitigate the risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for httpie →
FAQ
CVE-2022-0430 is a vulnerability in the httpie package that allows unauthorized access to sensitive information.
Versions of httpie prior to 3.1.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade, ensure that sensitive information is not logged or exposed in your HTTP requests or responses.
The CVSS score for CVE-2022-0430 is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for httpie.
