[SECURITY] Fedora 39 Update: yt-dlp-2024.07.09-1.fc39

yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...

Fedora 39 : yt-dlp (2024-72fb215fcd)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-72fb215fcd advisory. Update to 2024.07.09 ---- Update to 2024.07.07 ---- Update to 2024.07.02 Tenable has extracted the preceding description block directly from the Fedora...

yt-dlp Command Injection Code Execution

The vulnerability of the YouTube-DLP download utility exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Supply Chain Attack

yt-dlp is vulnerable to Supply Chain Attack. The vulnerability is due to the use of a compromised CDN cdn.bootcdn.net which is used to fetch a component of the crypto-js JavaScript library, allowing an attacker to potentially inject and execute malicious JavaScript code...

yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

GHSA-3V33-3WMW-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +64 more potentially affected by unknown CVE via yt-dlp (>=2023.9.24, <=2024.7.2)

yt-dlp PYPI version =2023.9.24, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.9.0, =1.4.0, =1.1.1, =0.1.0, =1.0.2, =1.0.1.1, =2.0.0a1, =2.3.10, =0.2.0, =0.2.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3V33-3WMW-3785...

africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +64 more potentially affected by unknown CVE via yt-dlp (>=2023.9.24, <=2024.7.2)

yt-dlp PYPI version =2023.9.24, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.9.0, =1.4.0, =1.1.1, =0.1.0, =1.0.2, =1.0.1.1, =2.0.0a1, =2.3.10, =0.2.0, =0.2.1 and more Source cves: unknown CVE Source advisory: GHSA-3V33-3WMW-3785...

[SECURITY] Fedora 40 Update: yt-dlp-2024.07.02-1.fc40

yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...

Fedora 40 : yt-dlp (2024-0ba1c1a435)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0ba1c1a435 advisory. Update to 2024.07.02 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Path Traversal

yt-dlp is vulnerable to Path Traversal. The vulnerability is due to unrestricted file extensions of downloaded files resulting in arbitrary filenames and path traversal on Windows, which could allows an attacker to execute arbitrary code...

OPENSUSE-SU-2024:14094-1 python310-yt-dlp-2024.07.01-1.1 on GA media

These are all security issues fixed in the python310-yt-dlp-2024.07.01-1.1 package on the GA media of openSUSE Tumbleweed...

basketcase (>=0.0.4, <=1.0.0) potentially affected by CVE-2024-38519 via yt-dlp (2021.9.2)

yt-dlp PYPI version 2021.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase =0.0.4, =1.0.0 Source cves: CVE-2024-38519 Source advisory: OSV:GHSA-79W7-VH3H-8G4J...

basketcase (1.0.1) potentially affected by CVE-2024-38519 via yt-dlp (2021.10.22)

yt-dlp PYPI version 2021.10.22 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 1.0.1 Source cves: CVE-2024-38519 Source advisory: OSV:GHSA-79W7-VH3H-8G4J...

songbird-py (>=0.1.1, <=0.1.5) potentially affected by CVE-2024-38519 via yt-dlp (2021.12.1)

yt-dlp PYPI version 2021.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - songbird-py =0.1.1, =0.1.5 Source cves: CVE-2024-38519 Source advisory: OSV:GHSA-79W7-VH3H-8G4J...

basketcase (>=1.0.2, <=1.0.4), gharbala (>=0.1.3, <=0.1.9) +2 more potentially affected by CVE-2024-38519 via yt-dlp (2021.12.27)

yt-dlp PYPI version 2021.12.27 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase =1.0.2, =0.1.3, =0.4.0, =0.9.1, =1.0.3 Source cves: CVE-2024-38519 Source advisory: OSV:GHSA-79W7-VH3H-8G4J...

ytdl-sub (>=2023.6.22, <=2023.6.30.post1) potentially affected by CVE-2024-38519 via yt-dlp (2023.6.22)

yt-dlp PYPI version 2023.6.22 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ytdl-sub =2023.6.22, =2023.6.30.post1 Source cves: CVE-2024-38519 Source advisory: OSV:GHSA-79W7-VH3H-8G4J...

GHSA-79W7-VH3H-8G4J yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...

yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...

amusing-app (>=0.2.0, <=0.4.2), buzz-captions (>=1.0.0, <=1.1.0) +10 more potentially affected by CVE-2024-38519 via yt-dlp (>=2024.3.10, <=2024.5.27)

yt-dlp PYPI version =2024.3.10, =0.2.0, =1.0.0, =1.3.5, =0.6.22, =0.2.0, =0.0.5, =0.0.1, =0.1.50, =0.8.0, =2024.3.19, =2024.6.6 Source cves: CVE-2024-38519 Source advisory: GHSA-79W7-VH3H-8G4J...