{"id":"CVE-2019-10751","aliases":["DEBIAN-CVE-2019-10751","DLA-1937-1","EUVD-2019-0060","GHSA-xjjg-vmw6-c2p9","MGASA-2019-0351","PYSEC-2019-23","SNYK-PYTHON-HTTPIE-460107","UBUNTU-CVE-2019-10751","openSUSE-SU-2019:2050-1","openSUSE-SU-2019:2089-1","openSUSE-SU-2024:10849-1"],"status":"published","title":"Open Redirect in httpie","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02037,"percentile":0.81247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2019-08-23T16:38:35Z","modified":"2026-10-20T10:50:38Z","fixes":[{"ecosystem":"PyPI","package":"httpie","fixed_in":["1.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"httpie","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"httpie","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"httpie","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"httpie","fixed_in":["0.8.0-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"httpie","fixed_in":["1.0.3-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"httpie","fixed_in":["0.8.0-1+deb8u1build0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"httpie","fixed_in":["1.0.3-bp151.2.3.1","1.0.3-bp151.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"httpie","fixed_in":["1.0.3-bp151.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"httpie","fixed_in":["2.5.0-1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1+deb8u1"}]}],"versions":["0.8.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}],"versions":["0.1","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.4dev","0.2.5","0.2.6","0.2.7","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.7.0","0.7.2","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.2"]},{"source":"osv","ecosystem":"Mageia:7","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1.mga7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}],"versions":["0.1","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4dev","0.2.4","0.2.5","0.2.6","0.2.7","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.7.0","0.7.2","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1+deb8u1build0.14.04.1~esm1"}]}],"versions":["0.3.1-1","0.7.1-0.1","0.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-0.1","0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.8-2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-bp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-bp151.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-bp151.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"httpie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.2"}]}]}],"products":[{"vendor":"httpie","product":"httpie"}],"references":[{"url":"https://snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory","report"]},{"url":"https://github.com/jakubroztocil/httpie/releases/tag/1.0.3","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10751","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xjjg-vmw6-c2p9","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/httpie/PYSEC-2019-23.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10751","tags":["advisory"]},{"url":"https://github.com/jakubroztocil/httpie","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2019-0351.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25764","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-09/msg00009.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-10751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10751","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4LKCRORAU5FUMSVHWG5HM24YMA2NRGIT/#4LKCRORAU5FUMSVHWG5HM24YMA2NRGIT","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1148466","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10751","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GTLZBGOOZKEPVX6GAQCBUMJ6MXEPRK5I/#GTLZBGOOZKEPVX6GAQCBUMJ6MXEPRK5I","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10751","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T16:38:35Z","modified":"2024-08-04T22:32:01.703Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-0060","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T16:38:35Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-xjjg-vmw6-c2p9","title":"Open Redirect in httpie","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-27T17:44:33Z","modified":"2024-09-20T21:26:31Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2019-10751","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T17:15:13.543Z","modified":"2026-06-17T02:11:36.103Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"CVE-2019-10751","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T17:15:13.543Z","modified":"2026-10-20T10:50:38.349412866Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10751","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T17:15:13.543Z","modified":"2026-09-21T07:00:35.108017929Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-xjjg-vmw6-c2p9","title":"Open Redirect in httpie","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-27T17:44:33Z","modified":"2026-09-10T03:48:44.436762468Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"UBUNTU-CVE-2019-10751","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T17:15:00Z","modified":"2025-10-24T04:47:36Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1937-1","title":"httpie - security update","status":"published","published":"2019-09-28T00:00:00Z","modified":"2026-03-09T01:19:21.533648Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0351","title":"Updated httpie packages fix security vulnerability","description":"Updated httpie packages fix security vulnerability:\n\nHTTPie is vulnerable to Open Redirect that allows an attacker to write\nan arbitrary file with supplied filename and content to the current\ndirectory, by redirecting a request from HTTP to a crafted URL pointing\nto a server in his or her control (CVE-2019-10751).\n","status":"published","published":"2019-11-30T13:06:06Z","modified":"2026-04-16T04:40:51.841669242Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2050-1","title":"Security update for httpie","description":"This update for httpie fixes the following issues:\n\nhttpie was updated to version 1.0.3:\n\n* Fix CVE-2019-10751 (HTTPie is volnerable to Open Redirect that\n  allows an attacker to write an arbitrary file with supplied\n  filename and content to the current directory, by redirecting\n  a request from HTTP to a crafted URL pointing to a server in\n  his or hers control. (bsc#1148466)\n\n","status":"published","published":"2019-09-02T10:32:39Z","modified":"2026-02-04T04:10:03.21932Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2089-1","title":"Security update for httpie","description":"This update for httpie fixes the following issues:\n\nhttpie was updated to version 1.0.3:\n\n* Fix CVE-2019-10751 (HTTPie is vulnerable to Open Redirect that\n  allows an attacker to write an arbitrary file with supplied\n  filename and content to the current directory, by redirecting\n  a request from HTTP to a crafted URL pointing to a server in\n  his or hers control. (bsc#1148466)\n\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-09-07T14:23:00Z","modified":"2026-02-04T03:50:32.12414Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10849-1","title":"httpie-2.5.0-1.2 on GA media","description":"These are all security issues fixed in the httpie-2.5.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:04.744767Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"PYSEC-2019-23","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","status":"published","published":"2019-08-23T17:15:00Z","modified":"2023-11-08T04:00:54.897717Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}