CVE-2024-1892 (High) detected in Scrapy-2.9.0-py2.py3-none-any.whl

[mend-bolt-for-github]

CVE-2024-1892 - High Severity Vulnerability

Vulnerable Library - Scrapy-2.9.0-py2.py3-none-any.whl

A high-level Web Crawling and Web Scraping framework

Library home page: https://files.pythonhosted.org/packages/29/87/4129a19d4d56092ed0f63e0739832d145690981631d32f3ac6e438ec0d25/Scrapy-2.9.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Scrapy-2.9.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: ef3d24fa88d80ad14eb3a3575dccaaa2f74d313d

Found in base branch: main

Vulnerability Details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.

Publish Date: 2024-02-28

URL: CVE-2024-1892

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-1892

Release Date: 2024-02-28

Fix Resolution: scrapy - 2.11.1

---

Step up your Open Source Security Game with Mend here