CVE catalog

CVE-2024-22049

ruby-httparty: CVE-2024-22049

Severity: Medium
Published: Jan 4, 2024, 9:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.29% · Oct 25, 2026

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ruby-httparty	sid	`0.24.3-1`	fixed
Debian	ruby-httparty	forky	`0.24.3-1`	fixed
Debian	ruby-httparty	trixie	`0.21.0-1`	fixed
Debian	ruby-httparty	bookworm	`0.21.0-1`	fixed
Ubuntu	ruby-httparty	16.04	`0.13.5-1`	vulnerable
Ubuntu	ruby-httparty	18.04	`0.13.7-1`	vulnerable
Ubuntu	ruby-httparty	18.04	`0.13.7-2`	vulnerable
Ubuntu	ruby-httparty	18.04	`0.15.6-1`	vulnerable
Ubuntu	ruby-httparty	20.04	`0.17.0-1`	vulnerable
Ubuntu	ruby-httparty	22.04	`0.18.1-2`	vulnerable
Ubuntu	ruby-httparty	22.04	`0.18.1-3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ruby-httparty	source	sid	`0.21.0-1`	not yet assigned	Not reported	Not reported
Debian	ruby-httparty	source	forky	`0.21.0-1`	not yet assigned	Not reported	Not reported
Debian	ruby-httparty	source	trixie	`0.21.0-1`	not yet assigned	Not reported	Not reported
Debian	ruby-httparty	source	bookworm	`0.21.0-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]