CVE-2024-1892
Published: 28 February 2024
Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
python-scrapy Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| jammy |
Needs triage
|
|
| mantic |
Needs triage
|
|
| noble |
Needs triage
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
References
- https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b/
- https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5 (2.11.1)
- https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b
- https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5
- https://www.cve.org/CVERecord?id=CVE-2024-1892
- NVD
- Launchpad
- Debian