Bug 834801 (CVE-2022-0430, CVE-2022-24737)

Summary:	<net-misc/httpie-3.2.1: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	slashbeast
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fq
Whiteboard:	B4 [glsa?]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-03-09 01:21:49 UTC

CVE-2022-24737:

HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didnâ€˜t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.

Fix is in 3.1.0, please bump.

Comment 1 John Helmert III archtester

2022-03-15 16:40:42 UTC

CVE-2022-0430 (https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b):
https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.