Bug 2256881 (CVE-2024-22049)

Summary:	CVE-2024-22049 httparty: multipart/form-data request vulnerable to tampering
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	httparty 0.21.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2256883, 2256882
Bug Blocks:

Description Robb Gatica 2024-01-04 23:53:33 UTC

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written. 

References:
https://github.com/advisories/GHSA-5pq7-52mg-hr42 	
https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43 	
https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e 	
https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42 	
https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42

Comment 1 Robb Gatica 2024-01-04 23:53:47 UTC

Created rubygem-httparty tracking bugs for this issue:

Affects: fedora-all [bug 2256882]

Comment 2 Robb Gatica 2024-01-04 23:54:57 UTC

Created rubygem-httparty tracking bugs for this issue:

Affects: epel-all [bug 2256883]