Vulnerability · Published Feb 28, 2024 · Assigned by @huntr_ai
CVE-2024-1892ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
High 7.5
In plain English
A high-severity regular-expression denial of service in scrapy/scrapy from scrapy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-scrapy | no fix listed | DEBIAN-CVE-2024-1892 |
| Debian:13 | python-scrapy | 2.11.1-1 | DEBIAN-CVE-2024-1892 |
| Debian:14 | python-scrapy | 2.11.1-1 | DEBIAN-CVE-2024-1892 |
| PyPI | scrapy | 2.11.1 | GHSA-cc65-xxvf-f7r9 |
| PyPI | scrapy | 1.8.4 | GHSA-cc65-xxvf-f7r9 |
| PyPI | scrapy | 2.11.1 | PYSEC-2024-162 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| scrapy | scrapy/scrapy | unspecified – before 2.11 |
Weakness: CWE-1333 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H