CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

CVE-2024-1892: Inefficient Regular Expression Complexity

A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker...

Scrapy Security Vulnerabilities

Scrapy is a free and open source web crawler framework written in Python. A security vulnerability exists in Scrapy that stems from the use of vulnerable regular expressions for parsing, where processing a malicious response may result in extreme CPU and memory usage during parsing of its content...

Decompression Bomb

scrapy is vulnerable to Decompression Bomb. The vulnerability is caused due to not enforcing validating the maximum size of decompressed data and applying the check only on compressed one. The existing checks only applied to settings DOWNLOADMAXSIZE and DOWNLOADWARNSIZE which only exist on...

GHSA-7J7M-V7M3-JQM7 Scrapy decompression bomb vulnerability

Impact Scrapy limits allowed response sizes by default through the DOWNLOADMAXSIZE and DOWNLOADWARNSIZE settings. However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to...

Scrapy decompression bomb vulnerability

Impact Scrapy limits allowed response sizes by default through the DOWNLOADMAXSIZE and DOWNLOADWARNSIZE settings. However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to...

Authorization Header Leakage

scrapy is vulnerable to Authorization Header Leakage. The vulnerability is due to improper handling of the Authorization header when the response includes a redirection. The Authorization header is not ommited when Scrapy is redirected, resulting in the Authorization header being sent to the...

Regular Expression Denial Of Service (ReDoS)

scrapy is vulnerable to Regular expression Denial of Service ReDoS. The vulnerability is due to the usage of a regular expression with Inefficient complexity. This may cause extreme CPU and memory usage due, leading to Regular expression Denial of Service ReDoS...

PT-2024-26670

Name of the Vulnerable Software and Affected Versions scrapy/scrapy affected versions not specified Description The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This issue...

Scrapy authorization header leakage on cross-domain redirect

Impact When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain...

GHSA-CW9J-Q3VF-HRRV Scrapy authorization header leakage on cross-domain redirect

Impact When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain...

Scrapy vulnerable to ReDoS via XMLFeedSpider

Impact The following parts of the Scrapy API were found to be vulnerable to a ReDoS attack: - The XMLFeedSpider class or any subclass that uses the default node iterator: iternodes, as well as direct uses of the scrapy.utils.iterators.xmliter function. - Scrapy 2.6.0 to 2.11.0: The openinbrowser...

GHSA-CC65-XXVF-F7R9 Scrapy vulnerable to ReDoS via XMLFeedSpider

Impact The following parts of the Scrapy API were found to be vulnerable to a ReDoS attack: - The XMLFeedSpider class or any subclass that uses the default node iterator: iternodes, as well as direct uses of the scrapy.utils.iterators.xmliter function. - Scrapy 2.6.0 to 2.11.0: The openinbrowser...

PT-2024-26692

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.11.1 Description The issue arises from the failure to remove the Authorization header when redirecting across domains, potentially allowing for account hijacking. This occurs when a request with the Authorization...

PT-2024-18399 · Scrapy +3 · Scrapy +3

Name of the Vulnerable Software and Affected Versions: Scrapy versions 2.6.0 through 2.11.0 Scrapy versions prior to 1.8.4 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the XMLFeedSpider class of the Scrapy project, specifically in the parsing of XML content. B...

FreeBSD : py-Scrapy -- cookie injection vulnerability (a5403af6-225e-48ba-b233-bd95ad26434a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a5403af6-225e-48ba-b233-bd95ad26434a advisory. - Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses...

FreeBSD : py-Scrapy -- exposure of sensitive information vulnerability (67fe5e5b-549f-4a2a-9834-53f60eaa415e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 67fe5e5b-549f-4a2a-9834-53f60eaa415e advisory. - Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior t...