CVE-2024-3572

CVE-2024-3572 – Summary The Scrapy project (scrapy/scrapy) is vulnerable to XML External Entity (XXE) attacks due to parsing untrusted XML with lxml.etree.fromstring without proper validation. The underlying issue lies in how XML is parsed, enabling a remote attacker to cause denial of service, a...

Scrapy 安全漏洞

Scrapy is a free and open source web crawler framework written in Python. A security vulnerability exists in Scrapy that stems from the use of lxml.etree.fromstring to parse untrusted XML data without proper validation, allowing an attacker to perform a denial-of-service attack, access a local...

Scrapy 信息泄露漏洞

Scrapy is a free and open source web crawler framework written in Python. An information disclosure vulnerability exists in Scrapy version 2.10.1, which stems from a failure to remove the authorization header during a cross-domain redirect, exposing the authorization header to unauthorized...

SUSE CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

ReDoS (Regular Expression Denial Of Service)

scrapy is vulnerable to ReDoS Regular Expression Denial Of Service. The vulnerability is due to a Regular Expression with inefficient complexity which is used to parse XML content when utilizing the XMLFeedSpider class when scraping XML. If the class is utilized to scrape an attacker-controlled w...

Duplicate Advisory: ReDos vulnerability of XMLFeedSpider

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cc65-xxvf-f7r9. This link is maintained to preserve external references. Original Description Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause...

GHSA-7C9G-VJ9M-8PM6 Duplicate Advisory: ReDos vulnerability of XMLFeedSpider

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cc65-xxvf-f7r9. This link is maintained to preserve external references. Original Description Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause...

PYSEC-2024-162

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

DEBIAN-CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

PYSEC-2024-162

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

Code injection

Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing...

CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

UBUNTU-CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892

CVE-2024-1892 is a ReDoS vulnerability in Scrapy’s XMLFeedSpider class during XML parsing. The issue arises from inefficient regular expressions used in parsing XML content, enabling an attacker to cause a denial-of-service by crafting malicious XML that can exhaust CPU and memory, potentially ma...

Scrapy Security Vulnerabilities

Scrapy is a free and open source web crawler framework written in Python. A security vulnerability exists in Scrapy that stems from the use of vulnerable regular expressions for parsing, where processing a malicious response may result in extreme CPU and memory usage during parsing of its content...