CVE-2022-0430: Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
Other sources
httpie is a modern, user-friendly command-line HTTP client for the API era. Prior to version 3.1.0, all cookies saved to session storage are supercookies. At this time, there is no known workaround. Users are recommended to update to version 3.1.0.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/httpieto a version that resolves this vulnerability.Fixed in 3.1.0 - Upgrade
Upgrade
debian/httpieto a version that resolves this vulnerability.Fixed in 3.2.1-1Fixed in 3.2.4-3Fixed in 3.2.4-4 - Upgrade
Upgrade
debian/httpieto a version that resolves this vulnerability.Fixed in 3.2.1-1 - Upgrade
Upgrade
httpie/httpieto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0430?
The severity of CVE-2022-0430 is medium with a score of 5.3.
How does CVE-2022-0430 expose sensitive information?
CVE-2022-0430 exposes sensitive information to an unauthorized actor.
Which version of Httpie is affected by CVE-2022-0430?
Httpie prior to version 3.1.0 is affected by CVE-2022-0430.
How can I fix CVE-2022-0430?
To fix CVE-2022-0430, update Httpie to version 3.1.0 or later.
Where can I find more information about CVE-2022-0430?
You can find more information about CVE-2022-0430 in the references provided: [GitHub commit](https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b) and [Huntr bounty](https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f).