PyPI/scrapy CVE-2024-3572: high 7.5, EPSS 0.81%
Scrapy decompression bomb vulnerability
Action: Upgrade scrapy to 1.8.4 or later.
pip install scrapy==2.11.1pip install scrapy==1.8.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.11.1 | - |
| 0 | 1.8.4 | - |
Fixed versions
| 2.11.1 | 1.8.4 |
Sources
- osv: GHSA-7j7m-v7m3-jqm7
- https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7
- https://nvd.nist.gov/vuln/detail/CVE-2024-3572
- https://github.com/scrapy/scrapy/commit/71b8741e3607cfda2833c7624d4ada87071aa8e5
- https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f
- https://docs.scrapy.org/en/latest/news.html#scrapy-2-11-1-2024-02-14
- https://github.com/scrapy/scrapy
- https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb
CVE-2024-3572 · published · modified · JSON