GHSA-8r96-8889-qg2x

HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack

Source: GitHub Advisory Database (reviewed) High CVE-2023-48052

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	httpie	< 3.2.3	3.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-48052 advisory
https://github.com/httpie/cli/issues/1549 web
https://github.com/httpie/cli/commit/7f03c52d2237440c5a672296ce6955aae4ed4f09 web
https://github.com/httpie/cli package
https://github.com/httpie/cli/blob/master/httpie/client.py#L33 web
https://github.com/httpie/cli/blob/master/httpie/internal/update_warnings.py#L44 web
https://github.com/pypa/advisory-database/tree/main/vulns/httpie/PYSEC-2023-242.yaml web
https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md web