CVE-2024-1892 (Medium) detected in Scrapy-2.6.2-py2.py3-none-any.whl

[mend-bolt-for-github]

CVE-2024-1892 - Medium Severity Vulnerability

Vulnerable Library - Scrapy-2.6.2-py2.py3-none-any.whl

A high-level Web Crawling and Web Scraping framework

Library home page: https://files.pythonhosted.org/packages/e2/8a/e3870cd597bbd4f47d7e1c97bbb67a6293270b9c413e083058ce6d6c7eb7/Scrapy-2.6.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Scrapy-2.6.2-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.

Publish Date: 2024-02-28

URL: CVE-2024-1892

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-1892

Release Date: 2024-02-28

Fix Resolution: scrapy - 2.11.1

---

Step up your Open Source Security Game with Mend here