UBUNTU-CVE-2019-10751: High severity ubuntu/httpie vulnerability

Q: Who is exposed to exploitation?

Users running HTTPie versions earlier than 1.0.3 are exposed when they make an HTTP request that an attacker can redirect to a crafted URL controlled by the attacker. Exploitation requires user interaction because the user must initiate the request.

Q: What can an attacker do if exploitation succeeds?

An attacker can cause an arbitrary file with an attacker-supplied filename and content to be written to the current directory from which HTTPie is run. The impact can include loss of confidentiality, integrity, and availability.

Q: Is network access alone enough to exploit this issue?

No. Although the vulnerable request can be redirected over the network, the attacker needs a user of a vulnerable HTTPie version to send an HTTP request that follows the crafted redirect.

Q: What version should be used to remediate the issue?

Upgrade HTTPie to version 1.0.3 or later. Versions before 1.0.3 are affected.

Published Aug 23, 2019

Updated

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.

Affected Software

3 affected componentsFixes available

ubuntu/httpie<0.8.0-1+deb8u1build0.14.04.1~esm1

0.8.0-1+deb8u1build0.14.04.1~esm1

ubuntu/httpie<0.9.2-1ubuntu0.1~esm1

0.9.2-1ubuntu0.1~esm1

ubuntu/httpie<0.9.8-2ubuntu0.1~esm1

0.9.8-2ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/httpie to a version that resolves this vulnerability.
Fixed in 0.8.0-1+deb8u1build0.14.04.1~esm1
Upgrade
Upgrade ubuntu/httpie to a version that resolves this vulnerability.
Fixed in 0.9.2-1ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/httpie to a version that resolves this vulnerability.
Fixed in 0.9.8-2ubuntu0.1~esm1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.3

Event History

Aug 23, 2019

CVE Published

via OSV·05:15 PM

Data Sourced

via OSV·05:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to exploitation?

Users running HTTPie versions earlier than 1.0.3 are exposed when they make an HTTP request that an attacker can redirect to a crafted URL controlled by the attacker. Exploitation requires user interaction because the user must initiate the request.

What can an attacker do if exploitation succeeds?

An attacker can cause an arbitrary file with an attacker-supplied filename and content to be written to the current directory from which HTTPie is run. The impact can include loss of confidentiality, integrity, and availability.

Is network access alone enough to exploit this issue?

No. Although the vulnerable request can be redirected over the network, the attacker needs a user of a vulnerable HTTPie version to send an HTTP request that follows the crafted redirect.

What version should be used to remediate the issue?

Upgrade HTTPie to version 1.0.3 or later. Versions before 1.0.3 are affected.

UBUNTU-CVE-2019-10751: High severity ubuntu/httpie vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What can an attacker do if exploitation succeeds?

Is network access alone enough to exploit this issue?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What can an attacker do if exploitation succeeds?

Is network access alone enough to exploit this issue?

What version should be used to remediate the issue?