Fedora 39 : python-scrapy (2024-0bd3b1212e)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0bd3b1212e advisory. - Update to 2.11.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

OPENSUSE-SU-2024:14130-1 python-Scrapy-doc-2.11.2-1.1 on GA media

These are all security issues fixed in the python-Scrapy-doc-2.11.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13802-1 python-Scrapy-doc-2.11.1-1.1 on GA media

These are all security issues fixed in the python-Scrapy-doc-2.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11558-1 python-Scrapy-doc-2.5.1-1.1 on GA media

These are all security issues fixed in the python-Scrapy-doc-2.5.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11889-1 python-Scrapy-doc-2.6.1-1.1 on GA media

These are all security issues fixed in the python-Scrapy-doc-2.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

Duplicate Advisory: Scrapy leaks the authorization header on same-domain but cross-origin redirects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4qqq-9vqf-3h3f. This link is maintained to preserve external references. Original Description In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only...

CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

PYSEC-2024-258

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

UBUNTU-CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968 Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968

CVE-2024-1968 affects Scrapy’s redirect middleware, specifically the _build_redirect_request path, where the Authorization header is not stripped when a redirect downgrades from HTTPS to HTTP within the same domain. This can leak credentials in plaintext during cross-origin-like redirects that ch...

CVE-2024-1968 Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968 Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

scrapy 信息泄露漏洞

Scrapy is a free and open source web crawler framework written in Python. An information disclosure vulnerability exists in scrapy that stems from the fact that the authorization header may be inadvertently exposed in plaintext, leading to the disclosure of potentially sensitive information...

Information Disclosure

scrapy is vulnerable to Information Disclosure. The vulnerability is due to redirects ignoring scheme specific proxy settings, which results in http / https schemes using the wrong proxy if the proxy was configured to be scheme specific...

Authorization Header Leakage

scrapy is vulnerable to Authorization Header Leakage. The vulnerability is due to including the authorization header during redirects, where the domain remains the same but the scheme or port changes...

Open Redirect

scrapy is vulnerable to Open Redirect. The vulnerability is due to indiscriminate handling of redirects across different URL schemes, which can result in redirecting requests to potentially malicious destinations, such as local files, malicious FTP servers, or S3 buckets. If an attacker has acces...

Scrapy allows redirect following in protocols other than HTTP

Impact Scrapy was following redirects regardless of the URL protocol, so redirects were working for data://, file://, ftp://, s3://, and any other scheme defined in the DOWNLOADHANDLERS setting. However, HTTP redirects should only work between URLs that use the http:// or https:// schemes. A...