USN-9071-1: HTTPie vulnerability
It was discovered that HTTPie used the final URL after following redirects to determine the output filename when downloading files. A remote attacker could possibly use this issue to write arbitrary files to the current directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/httpieto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/httpieto a version that resolves this vulnerability.Fixed in 0.9.2-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/httpieto a version that resolves this vulnerability.Fixed in 0.9.8-2ubuntu0.1~esm1
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
An attacker would need to cause HTTPie to follow redirects to a final URL crafted to influence the download output filename. The issue can result in arbitrary files being written to the directory from which HTTPie is run.
Who is exposed to this vulnerability?
Users who download files with HTTPie and allow it to follow redirects are exposed to a malicious remote server or redirect destination. The write is limited to the current working directory described in the advisory.