CVE-2019-10751 Open Redirect in httpie
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi httpie(PyPI) | < 1.0.3 | 1.0.3 |
| pypi httpie(PyPI) | = 0.1 | No fix listed |
| pypi httpie(PyPI) | = 0.1.1 | No fix listed |
| pypi httpie(PyPI) | = 0.1.2 | No fix listed |
| pypi httpie(PyPI) | = 0.1.3 | No fix listed |
| pypi httpie(PyPI) | = 0.1.4 | No fix listed |
| pypi httpie(PyPI) | = 0.1.5 | No fix listed |
| pypi httpie(PyPI) | = 0.1.6 | No fix listed |
| pypi httpie(PyPI) | = 0.2.0 | No fix listed |
| pypi httpie(PyPI) | = 0.2.1 | No fix listed |
| pypi httpie(PyPI) | = 0.2.2 | No fix listed |
| pypi httpie(PyPI) | = 0.2.3 | No fix listed |
| pypi httpie(PyPI) | = 0.2.4 | No fix listed |
| pypi httpie(PyPI) | = 0.2.4dev | No fix listed |
| pypi httpie(PyPI) | = 0.2.5 | No fix listed |
| pypi httpie(PyPI) | = 0.2.6 | No fix listed |
| pypi httpie(PyPI) | = 0.2.7 | No fix listed |
| pypi httpie(PyPI) | = 0.3.0 | No fix listed |
| pypi httpie(PyPI) | = 0.3.1 | No fix listed |
| pypi httpie(PyPI) | = 0.4.0 | No fix listed |
| pypi httpie(PyPI) | = 0.4.1 | No fix listed |
| pypi httpie(PyPI) | = 0.5.0 | No fix listed |
| pypi httpie(PyPI) | = 0.5.1 | No fix listed |
| pypi httpie(PyPI) | = 0.6.0 | No fix listed |
| pypi httpie(PyPI) | = 0.7.0 | No fix listed |
Show 33 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi httpie(PyPI) | = 0.7.2 | No fix listed |
| pypi httpie(PyPI) | = 0.8.0 | No fix listed |
| pypi httpie(PyPI) | = 0.9.0 | No fix listed |
| pypi httpie(PyPI) | = 0.9.1 | No fix listed |
| pypi httpie(PyPI) | = 0.9.2 | No fix listed |
| pypi httpie(PyPI) | = 0.9.3 | No fix listed |
| pypi httpie(PyPI) | = 0.9.4 | No fix listed |
| pypi httpie(PyPI) | = 0.9.5 | No fix listed |
| pypi httpie(PyPI) | = 0.9.6 | No fix listed |
| pypi httpie(PyPI) | = 0.9.7 | No fix listed |
| pypi httpie(PyPI) | = 0.9.8 | No fix listed |
| pypi httpie(PyPI) | = 0.9.9 | No fix listed |
| pypi httpie(PyPI) | = 1.0.0 | No fix listed |
| pypi httpie(PyPI) | = 1.0.2 | No fix listed |
| debian/httpie(Debian:12) | < 1.0.3-1 | 1.0.3-1 |
| debian/httpie(Debian:13) | < 1.0.3-1 | 1.0.3-1 |
| debian/httpie(Debian:14) | < 1.0.3-1 | 1.0.3-1 |
| httpie | All versions | No fix listed |
| alpine/httpie(Alpine:v3.10) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.11) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.12) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.13) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.14) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.15) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.16) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.17) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.18) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.19) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.20) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.21) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.22) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.23) | < 1.0.3-r0 | 1.0.3-r0 |
| alpine/httpie(Alpine:v3.24) | < 1.0.3-r0 | 1.0.3-r0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com product
- github.com release-notes third-party-advisory
- github.com
- [debian-lts-announce] 20190928 [SECURITY] [DLA 1937-1] httpie security update mailing-list
- snyk.io exploit third-party-advisory vendor-advisory
- openSUSE-SU-2019:2050 vendor-advisory
- openSUSE-SU-2019:2089 vendor-advisory
- Debian Security Tracker CVE-2019-10751 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking