PT-2022-16839 · Httpie+2 · Httpie+2

Glyph · Published 2022-03-07 · Updated 2025-04-23 · CVE-2022-24737

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HTTPie versions prior to 3.1.0

Description HTTPie is a command-line HTTP client that stores some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage through its concept of sessions. Before version 3.1.0, HTTPie did not distinguish between cookies and the hosts they belonged to. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third-party website.

Recommendations For versions prior to 3.1.0, users are advised to upgrade to version 3.1.0 or later to resolve the issue. There are no known workarounds for this problem.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2025-5823

CVE-2022-24737

GHSA-9W4W-CPC8-H2FQ

MGASA-2023-0196

PYSEC-2022-34

Affected Products

Alt Linux

Debian

Httpie

References · 27

• 🔥 https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24737.json · Exploit
• https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24737 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0196.html · Security Note
• https://osv.dev/vulnerability/CVE-2022-24737 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24737 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-34 · Vendor Advisory