Executive brief
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
Affected products
- PyPI httpie
Junglewise Threat Intelligence
CVE-2023-48052: PYSEC-2023-242 - Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in
CVE-2023-48052 · Severity: low · CVSS 3.1 · Published 2023-11-16
Technologies: httpie (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2022-167 - Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
- PYSEC-2022-34 - HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state
- PYSEC-2019-23 - All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file
- PYSEC-2019-93 - All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file