| Name | CVE-2023-48052 |
| Description | Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| httpie (PTS) | jessie, jessie (lts) | 0.8.0-1+deb8u1 | vulnerable |
| stretch | 0.9.8-1 | fixed |
| buster | 0.9.8-2 | fixed |
| bullseye | 2.2.0-2 | fixed |
| bookworm | 3.2.1-1 | vulnerable |
| sid, trixie | 3.2.4-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| httpie | source | stretch | (not affected) | | | |
| httpie | source | buster | (not affected) | | | |
| httpie | source | bullseye | (not affected) | | | |
| httpie | source | (unstable) | (unfixed) | unimportant | | |
Notes
[bullseye] - httpie <not-affected> (remote version check introduced in 3.2.0)
[buster] - httpie <not-affected> (remote version check introduced in 3.2.0)
https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md
The httpie tools do validate SSL certificates for user-provided URLs, and fail if invalid.
Only its internal version check (update_warnings.py) makes a verify=False call to a
https://packages.httpie.io/latest.json URL, with no security impact besides displaying the information.
Introduced by: https://github.com/httpie/cli/commit/003f2095d4e98b26220802f016a56be38bf9bd8d (v3.2.0)