CVE-2024-1892: Scrapy vulnerable to ReDoS via XMLFeedSpider
(updated )
The following parts of the Scrapy API were found to be vulnerable to a ReDoS attack:
References
- docs.scrapy.org/en/latest/news.html
- docs.scrapy.org/en/latest/news.html
- github.com/advisories/GHSA-cc65-xxvf-f7r9
- github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2024-162.yaml
- github.com/scrapy/scrapy
- github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5
- github.com/scrapy/scrapy/commit/73e7c0ed011a0565a1584b8052ec757b54e5270b
- github.com/scrapy/scrapy/security/advisories/GHSA-cc65-xxvf-f7r9
- huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b
- nvd.nist.gov/vuln/detail/CVE-2024-1892
Detect and mitigate CVE-2024-1892 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →