Merge ~elisehdy/ubuntu-cve-tracker:python-scrapy-patches into ubuntu-cve-tracker:master
- Git
- lp:~elisehdy/ubuntu-cve-tracker
- python-scrapy-patches
- Merge into master
Proposed by
Elise Hlady
| Status: | Merged |
|---|---|
| Merged at revision: | a6f4badd0139fab8a0b210af6fe7a3bed0696999 |
| Proposed branch: | ~elisehdy/ubuntu-cve-tracker:python-scrapy-patches |
| Merge into: | ubuntu-cve-tracker:master |
| Diff against target: |
252 lines (+42/-30) 6 files modified
active/CVE-2021-41125 (+6/-4) active/CVE-2022-0577 (+7/-5) active/CVE-2024-1892 (+7/-5) active/CVE-2024-1968 (+8/-6) active/CVE-2024-3572 (+7/-5) active/CVE-2024-3574 (+7/-5) |
| Related bugs: |
| Reviewer | Review Type | Date Requested | Status |
|---|---|---|---|
| Leonidas S. Barbosa | Approve | ||
|
Review via email:
|
|||
Commit message
Updates to UCT for python-scrapy USN
Description of the change
To post a comment you must log in.
Preview Diff
[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
| 1 | diff --git a/active/CVE-2021-41125 b/active/CVE-2021-41125 | |||
| 2 | index dc2e499..2765531 100644 | |||
| 3 | --- a/active/CVE-2021-41125 | |||
| 4 | +++ b/active/CVE-2021-41125 | |||
| 5 | @@ -1,3 +1,4 @@ | |||
| 6 | 1 | PublicDateAtUSN: 2021-10-06 18:15:00 UTC | ||
| 7 | 1 | Candidate: CVE-2021-41125 | 2 | Candidate: CVE-2021-41125 |
| 8 | 2 | PublicDate: 2021-10-06 18:15:00 UTC | 3 | PublicDate: 2021-10-06 18:15:00 UTC |
| 9 | 3 | References: | 4 | References: |
| 10 | @@ -6,6 +7,7 @@ References: | |||
| 11 | 6 | https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.http.basic_auth_header | 7 | https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.http.basic_auth_header |
| 12 | 7 | http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth | 8 | http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth |
| 13 | 8 | https://www.cve.org/CVERecord?id=CVE-2021-41125 | 9 | https://www.cve.org/CVERecord?id=CVE-2021-41125 |
| 14 | 10 | https://ubuntu.com/security/notices/USN-7476-1 | ||
| 15 | 9 | Description: | 11 | Description: |
| 16 | 10 | Scrapy is a high-level web crawling and scraping framework for Python. If | 12 | Scrapy is a high-level web crawling and scraping framework for Python. If |
| 17 | 11 | you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider | 13 | you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider |
| 18 | @@ -28,7 +30,7 @@ Mitigation: | |||
| 19 | 28 | Bugs: | 30 | Bugs: |
| 20 | 29 | Priority: medium | 31 | Priority: medium |
| 21 | 30 | Discovered-by: | 32 | Discovered-by: |
| 23 | 31 | Assigned-to: elisehdy | 33 | Assigned-to: |
| 24 | 32 | CVSS: | 34 | CVSS: |
| 25 | 33 | nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [6.5 MEDIUM] | 35 | nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [6.5 MEDIUM] |
| 26 | 34 | 36 | ||
| 27 | @@ -39,11 +41,11 @@ trusty_python-scrapy: ignored (end of standard support) | |||
| 28 | 39 | trusty/esm_python-scrapy: DNE | 41 | trusty/esm_python-scrapy: DNE |
| 29 | 40 | esm-infra-legacy/trusty_python-scrapy: DNE | 42 | esm-infra-legacy/trusty_python-scrapy: DNE |
| 30 | 41 | xenial_python-scrapy: ignored (end of standard support) | 43 | xenial_python-scrapy: ignored (end of standard support) |
| 32 | 42 | esm-apps/xenial_python-scrapy: needed | 44 | esm-apps/xenial_python-scrapy: ignored (changes too intrusive) |
| 33 | 43 | bionic_python-scrapy: ignored (end of standard support, was needed) | 45 | bionic_python-scrapy: ignored (end of standard support, was needed) |
| 35 | 44 | esm-apps/bionic_python-scrapy: needed | 46 | esm-apps/bionic_python-scrapy: released (1.5.0-1ubuntu0.1~esm1) |
| 36 | 45 | focal_python-scrapy: needed | 47 | focal_python-scrapy: needed |
| 38 | 46 | esm-apps/focal_python-scrapy: needed | 48 | esm-apps/focal_python-scrapy: released (1.7.3-1ubuntu0.1~esm1) |
| 39 | 47 | hirsute_python-scrapy: ignored (end of life) | 49 | hirsute_python-scrapy: ignored (end of life) |
| 40 | 48 | impish_python-scrapy: ignored (end of life) | 50 | impish_python-scrapy: ignored (end of life) |
| 41 | 49 | jammy_python-scrapy: not-affected (2.5.1-1) | 51 | jammy_python-scrapy: not-affected (2.5.1-1) |
| 42 | diff --git a/active/CVE-2022-0577 b/active/CVE-2022-0577 | |||
| 43 | index 85b6f50..19f6f6c 100644 | |||
| 44 | --- a/active/CVE-2022-0577 | |||
| 45 | +++ b/active/CVE-2022-0577 | |||
| 46 | @@ -1,9 +1,11 @@ | |||
| 47 | 1 | PublicDateAtUSN: 2022-03-02 04:15:00 UTC | ||
| 48 | 1 | Candidate: CVE-2022-0577 | 2 | Candidate: CVE-2022-0577 |
| 49 | 2 | PublicDate: 2022-03-02 04:15:00 UTC | 3 | PublicDate: 2022-03-02 04:15:00 UTC |
| 50 | 3 | References: | 4 | References: |
| 51 | 4 | https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585 | 5 | https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585 |
| 52 | 5 | https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a | 6 | https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a |
| 53 | 6 | https://www.cve.org/CVERecord?id=CVE-2022-0577 | 7 | https://www.cve.org/CVERecord?id=CVE-2022-0577 |
| 54 | 8 | https://ubuntu.com/security/notices/USN-7476-1 | ||
| 55 | 7 | Description: | 9 | Description: |
| 56 | 8 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub | 10 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub |
| 57 | 9 | repository scrapy/scrapy prior to 2.6.1. | 11 | repository scrapy/scrapy prior to 2.6.1. |
| 58 | @@ -13,7 +15,7 @@ Mitigation: | |||
| 59 | 13 | Bugs: | 15 | Bugs: |
| 60 | 14 | Priority: low | 16 | Priority: low |
| 61 | 15 | Discovered-by: | 17 | Discovered-by: |
| 63 | 16 | Assigned-to: elisehdy | 18 | Assigned-to: |
| 64 | 17 | CVSS: | 19 | CVSS: |
| 65 | 18 | nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [6.5 MEDIUM] | 20 | nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [6.5 MEDIUM] |
| 66 | 19 | 21 | ||
| 67 | @@ -22,14 +24,14 @@ Patches_python-scrapy: | |||
| 68 | 22 | upstream_python-scrapy: released (2.6.0, 1.8.2) | 24 | upstream_python-scrapy: released (2.6.0, 1.8.2) |
| 69 | 23 | trusty_python-scrapy: ignored (end of standard support) | 25 | trusty_python-scrapy: ignored (end of standard support) |
| 70 | 24 | xenial_python-scrapy: ignored (end of standard support) | 26 | xenial_python-scrapy: ignored (end of standard support) |
| 72 | 25 | esm-apps/xenial_python-scrapy: needed | 27 | esm-apps/xenial_python-scrapy: ignored (changes too intrusive) |
| 73 | 26 | bionic_python-scrapy: ignored (end of standard support, was needs-triage) | 28 | bionic_python-scrapy: ignored (end of standard support, was needs-triage) |
| 75 | 27 | esm-apps/bionic_python-scrapy: needed | 29 | esm-apps/bionic_python-scrapy: released (1.5.0-1ubuntu0.1~esm1) |
| 76 | 28 | focal_python-scrapy: needed | 30 | focal_python-scrapy: needed |
| 78 | 29 | esm-apps/focal_python-scrapy: needed | 31 | esm-apps/focal_python-scrapy: released (1.7.3-1ubuntu0.1~esm1) |
| 79 | 30 | impish_python-scrapy: ignored (end of life) | 32 | impish_python-scrapy: ignored (end of life) |
| 80 | 31 | jammy_python-scrapy: needed | 33 | jammy_python-scrapy: needed |
| 82 | 32 | esm-apps/jammy_python-scrapy: needed | 34 | esm-apps/jammy_python-scrapy: released (2.5.1-2ubuntu0.1~esm1) |
| 83 | 33 | kinetic_python-scrapy: ignored (end of life, was needs-triage) | 35 | kinetic_python-scrapy: ignored (end of life, was needs-triage) |
| 84 | 34 | lunar_python-scrapy: ignored (end of life, was needs-triage) | 36 | lunar_python-scrapy: ignored (end of life, was needs-triage) |
| 85 | 35 | mantic_python-scrapy: ignored (end of life, was needs-triage) | 37 | mantic_python-scrapy: ignored (end of life, was needs-triage) |
| 86 | diff --git a/active/CVE-2024-1892 b/active/CVE-2024-1892 | |||
| 87 | index 07ba23c..08f7556 100644 | |||
| 88 | --- a/active/CVE-2024-1892 | |||
| 89 | +++ b/active/CVE-2024-1892 | |||
| 90 | @@ -1,3 +1,4 @@ | |||
| 91 | 1 | PublicDateAtUSN: 2024-02-28 00:15:00 UTC | ||
| 92 | 1 | Candidate: CVE-2024-1892 | 2 | Candidate: CVE-2024-1892 |
| 93 | 2 | PublicDate: 2024-02-28 00:15:00 UTC | 3 | PublicDate: 2024-02-28 00:15:00 UTC |
| 94 | 3 | References: | 4 | References: |
| 95 | @@ -6,6 +7,7 @@ References: | |||
| 96 | 6 | https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b | 7 | https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b |
| 97 | 7 | https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5 | 8 | https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5 |
| 98 | 8 | https://www.cve.org/CVERecord?id=CVE-2024-1892 | 9 | https://www.cve.org/CVERecord?id=CVE-2024-1892 |
| 99 | 10 | https://ubuntu.com/security/notices/USN-7476-1 | ||
| 100 | 9 | Description: | 11 | Description: |
| 101 | 10 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the | 12 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the |
| 102 | 11 | XMLFeedSpider class of the scrapy/scrapy project, specifically in the | 13 | XMLFeedSpider class of the scrapy/scrapy project, specifically in the |
| 103 | @@ -21,7 +23,7 @@ Mitigation: | |||
| 104 | 21 | Bugs: | 23 | Bugs: |
| 105 | 22 | Priority: medium | 24 | Priority: medium |
| 106 | 23 | Discovered-by: | 25 | Discovered-by: |
| 108 | 24 | Assigned-to: elisehdy | 26 | Assigned-to: |
| 109 | 25 | CVSS: | 27 | CVSS: |
| 110 | 26 | nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [6.5 MEDIUM] | 28 | nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [6.5 MEDIUM] |
| 111 | 27 | 29 | ||
| 112 | @@ -29,13 +31,13 @@ Patches_python-scrapy: | |||
| 113 | 29 | upstream_python-scrapy: released (2.11.1-1, 1.8.4) | 31 | upstream_python-scrapy: released (2.11.1-1, 1.8.4) |
| 114 | 30 | trusty_python-scrapy: ignored (end of standard support) | 32 | trusty_python-scrapy: ignored (end of standard support) |
| 115 | 31 | xenial_python-scrapy: ignored (end of standard support) | 33 | xenial_python-scrapy: ignored (end of standard support) |
| 117 | 32 | esm-apps/xenial_python-scrapy: needed | 34 | esm-apps/xenial_python-scrapy: ignored (changes too intrusive) |
| 118 | 33 | bionic_python-scrapy: ignored (end of standard support) | 35 | bionic_python-scrapy: ignored (end of standard support) |
| 120 | 34 | esm-apps/bionic_python-scrapy: needed | 36 | esm-apps/bionic_python-scrapy: released (1.5.0-1ubuntu0.1~esm1) |
| 121 | 35 | focal_python-scrapy: needed | 37 | focal_python-scrapy: needed |
| 123 | 36 | esm-apps/focal_python-scrapy: needed | 38 | esm-apps/focal_python-scrapy: released (1.7.3-1ubuntu0.1~esm1) |
| 124 | 37 | jammy_python-scrapy: needed | 39 | jammy_python-scrapy: needed |
| 126 | 38 | esm-apps/jammy_python-scrapy: needed | 40 | esm-apps/jammy_python-scrapy: released (2.5.1-2ubuntu0.1~esm1) |
| 127 | 39 | mantic_python-scrapy: ignored (end of life, was needs-triage) | 41 | mantic_python-scrapy: ignored (end of life, was needs-triage) |
| 128 | 40 | noble_python-scrapy: not-affected (2.11.1-1) | 42 | noble_python-scrapy: not-affected (2.11.1-1) |
| 129 | 41 | esm-apps/noble_python-scrapy: not-affected (2.11.1-1) | 43 | esm-apps/noble_python-scrapy: not-affected (2.11.1-1) |
| 130 | diff --git a/active/CVE-2024-1968 b/active/CVE-2024-1968 | |||
| 131 | index 7057aae..89e5436 100644 | |||
| 132 | --- a/active/CVE-2024-1968 | |||
| 133 | +++ b/active/CVE-2024-1968 | |||
| 134 | @@ -1,9 +1,11 @@ | |||
| 135 | 1 | PublicDateAtUSN: 2024-05-20 08:15:00 UTC | ||
| 136 | 1 | Candidate: CVE-2024-1968 | 2 | Candidate: CVE-2024-1968 |
| 137 | 2 | PublicDate: 2024-05-20 08:15:00 UTC | 3 | PublicDate: 2024-05-20 08:15:00 UTC |
| 138 | 3 | References: | 4 | References: |
| 139 | 4 | https://www.cve.org/CVERecord?id=CVE-2024-1968 | 5 | https://www.cve.org/CVERecord?id=CVE-2024-1968 |
| 140 | 5 | https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a | 6 | https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a |
| 141 | 6 | https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8 | 7 | https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8 |
| 142 | 8 | https://ubuntu.com/security/notices/USN-7476-1 | ||
| 143 | 7 | Description: | 9 | Description: |
| 144 | 8 | In scrapy/scrapy, an issue was identified where the Authorization header is | 10 | In scrapy/scrapy, an issue was identified where the Authorization header is |
| 145 | 9 | not removed during redirects that only change the scheme (e.g., HTTPS to | 11 | not removed during redirects that only change the scheme (e.g., HTTPS to |
| 146 | @@ -20,20 +22,20 @@ Mitigation: | |||
| 147 | 20 | Bugs: | 22 | Bugs: |
| 148 | 21 | Priority: medium | 23 | Priority: medium |
| 149 | 22 | Discovered-by: | 24 | Discovered-by: |
| 151 | 23 | Assigned-to: elisehdy | 25 | Assigned-to: |
| 152 | 24 | CVSS: | 26 | CVSS: |
| 153 | 25 | 27 | ||
| 154 | 26 | Patches_python-scrapy: | 28 | Patches_python-scrapy: |
| 155 | 27 | upstream_python-scrapy: released (2.11.2) | 29 | upstream_python-scrapy: released (2.11.2) |
| 158 | 28 | esm-apps/xenial_python-scrapy: needed | 30 | esm-apps/xenial_python-scrapy: ignored (changes too intrusive) |
| 159 | 29 | esm-apps/bionic_python-scrapy: needed | 31 | esm-apps/bionic_python-scrapy: released (1.5.0-1ubuntu0.1~esm1) |
| 160 | 30 | focal_python-scrapy: needed | 32 | focal_python-scrapy: needed |
| 162 | 31 | esm-apps/focal_python-scrapy: needed | 33 | esm-apps/focal_python-scrapy: released (1.7.3-1ubuntu0.1~esm1) |
| 163 | 32 | jammy_python-scrapy: needed | 34 | jammy_python-scrapy: needed |
| 165 | 33 | esm-apps/jammy_python-scrapy: needed | 35 | esm-apps/jammy_python-scrapy: released (2.5.1-2ubuntu0.1~esm1) |
| 166 | 34 | mantic_python-scrapy: ignored (end of life, was needs-triage) | 36 | mantic_python-scrapy: ignored (end of life, was needs-triage) |
| 167 | 35 | noble_python-scrapy: needed | 37 | noble_python-scrapy: needed |
| 169 | 36 | esm-apps/noble_python-scrapy: needed | 38 | esm-apps/noble_python-scrapy: released (2.11.1-1ubuntu0.1~esm2) |
| 170 | 37 | oracular_python-scrapy: not-affected (2.11.2-1) | 39 | oracular_python-scrapy: not-affected (2.11.2-1) |
| 171 | 38 | plucky_python-scrapy: not-affected (2.12.0-2) | 40 | plucky_python-scrapy: not-affected (2.12.0-2) |
| 172 | 39 | devel_python-scrapy: not-affected (2.12.0-2) | 41 | devel_python-scrapy: not-affected (2.12.0-2) |
| 173 | diff --git a/active/CVE-2024-3572 b/active/CVE-2024-3572 | |||
| 174 | index d4e9338..48f15be 100644 | |||
| 175 | --- a/active/CVE-2024-3572 | |||
| 176 | +++ b/active/CVE-2024-3572 | |||
| 177 | @@ -1,3 +1,4 @@ | |||
| 178 | 1 | PublicDateAtUSN: 2024-04-16 00:15:00 UTC | ||
| 179 | 1 | Candidate: CVE-2024-3572 | 2 | Candidate: CVE-2024-3572 |
| 180 | 2 | PublicDate: 2024-04-16 00:15:00 UTC | 3 | PublicDate: 2024-04-16 00:15:00 UTC |
| 181 | 3 | References: | 4 | References: |
| 182 | @@ -6,6 +7,7 @@ References: | |||
| 183 | 6 | https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f (2.11.1) | 7 | https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f (2.11.1) |
| 184 | 7 | https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7 | 8 | https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7 |
| 185 | 8 | https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f | 9 | https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f |
| 186 | 10 | https://ubuntu.com/security/notices/USN-7476-1 | ||
| 187 | 9 | Description: | 11 | Description: |
| 188 | 10 | The scrapy/scrapy project is vulnerable to XML External Entity (XXE) | 12 | The scrapy/scrapy project is vulnerable to XML External Entity (XXE) |
| 189 | 11 | attacks due to the use of lxml.etree.fromstring for parsing untrusted XML | 13 | attacks due to the use of lxml.etree.fromstring for parsing untrusted XML |
| 190 | @@ -19,17 +21,17 @@ Mitigation: | |||
| 191 | 19 | Bugs: | 21 | Bugs: |
| 192 | 20 | Priority: medium | 22 | Priority: medium |
| 193 | 21 | Discovered-by: | 23 | Discovered-by: |
| 195 | 22 | Assigned-to: elisehdy | 24 | Assigned-to: |
| 196 | 23 | CVSS: | 25 | CVSS: |
| 197 | 24 | 26 | ||
| 198 | 25 | Patches_python-scrapy: | 27 | Patches_python-scrapy: |
| 199 | 26 | upstream_python-scrapy: released (2.11.1-1, 1.8.4) | 28 | upstream_python-scrapy: released (2.11.1-1, 1.8.4) |
| 202 | 27 | esm-apps/xenial_python-scrapy: needed | 29 | esm-apps/xenial_python-scrapy: ignored (changes too intrusive) |
| 203 | 28 | esm-apps/bionic_python-scrapy: needed | 30 | esm-apps/bionic_python-scrapy: released (1.5.0-1ubuntu0.1~esm1) |
| 204 | 29 | focal_python-scrapy: needed | 31 | focal_python-scrapy: needed |
| 206 | 30 | esm-apps/focal_python-scrapy: needed | 32 | esm-apps/focal_python-scrapy: released (1.7.3-1ubuntu0.1~esm1) |
| 207 | 31 | jammy_python-scrapy: needed | 33 | jammy_python-scrapy: needed |
| 209 | 32 | esm-apps/jammy_python-scrapy: needed | 34 | esm-apps/jammy_python-scrapy: released (2.5.1-2ubuntu0.1~esm1) |
| 210 | 33 | mantic_python-scrapy: ignored (end of life, was needs-triage) | 35 | mantic_python-scrapy: ignored (end of life, was needs-triage) |
| 211 | 34 | noble_python-scrapy: not-affected (2.11.1-1) | 36 | noble_python-scrapy: not-affected (2.11.1-1) |
| 212 | 35 | esm-apps/noble_python-scrapy: not-affected (2.11.1-1) | 37 | esm-apps/noble_python-scrapy: not-affected (2.11.1-1) |
| 213 | diff --git a/active/CVE-2024-3574 b/active/CVE-2024-3574 | |||
| 214 | index 647da07..19554f9 100644 | |||
| 215 | --- a/active/CVE-2024-3574 | |||
| 216 | +++ b/active/CVE-2024-3574 | |||
| 217 | @@ -1,3 +1,4 @@ | |||
| 218 | 1 | PublicDateAtUSN: 2024-04-16 00:15:00 UTC | ||
| 219 | 1 | Candidate: CVE-2024-3574 | 2 | Candidate: CVE-2024-3574 |
| 220 | 2 | PublicDate: 2024-04-16 00:15:00 UTC | 3 | PublicDate: 2024-04-16 00:15:00 UTC |
| 221 | 3 | References: | 4 | References: |
| 222 | @@ -6,6 +7,7 @@ References: | |||
| 223 | 6 | https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9 | 7 | https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9 |
| 224 | 7 | https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 (2.11.1) | 8 | https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 (2.11.1) |
| 225 | 8 | https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 | 9 | https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 |
| 226 | 10 | https://ubuntu.com/security/notices/USN-7476-1 | ||
| 227 | 9 | Description: | 11 | Description: |
| 228 | 10 | In scrapy version 2.10.1, an issue was identified where the Authorization | 12 | In scrapy version 2.10.1, an issue was identified where the Authorization |
| 229 | 11 | header, containing credentials for server authentication, is leaked to a | 13 | header, containing credentials for server authentication, is leaked to a |
| 230 | @@ -19,17 +21,17 @@ Mitigation: | |||
| 231 | 19 | Bugs: | 21 | Bugs: |
| 232 | 20 | Priority: medium | 22 | Priority: medium |
| 233 | 21 | Discovered-by: | 23 | Discovered-by: |
| 235 | 22 | Assigned-to: elisehdy | 24 | Assigned-to: |
| 236 | 23 | CVSS: | 25 | CVSS: |
| 237 | 24 | 26 | ||
| 238 | 25 | Patches_python-scrapy: | 27 | Patches_python-scrapy: |
| 239 | 26 | upstream_python-scrapy: released (2.11.1-1, 1.8.4) | 28 | upstream_python-scrapy: released (2.11.1-1, 1.8.4) |
| 242 | 27 | esm-apps/xenial_python-scrapy: needed | 29 | esm-apps/xenial_python-scrapy: ignored (changes too intrusive) |
| 243 | 28 | esm-apps/bionic_python-scrapy: needed | 30 | esm-apps/bionic_python-scrapy: released (1.5.0-1ubuntu0.1~esm1) |
| 244 | 29 | focal_python-scrapy: needed | 31 | focal_python-scrapy: needed |
| 246 | 30 | esm-apps/focal_python-scrapy: needed | 32 | esm-apps/focal_python-scrapy: released (1.7.3-1ubuntu0.1~esm1) |
| 247 | 31 | jammy_python-scrapy: needed | 33 | jammy_python-scrapy: needed |
| 249 | 32 | esm-apps/jammy_python-scrapy: needed | 34 | esm-apps/jammy_python-scrapy: released (2.5.1-2ubuntu0.1~esm1) |
| 250 | 33 | mantic_python-scrapy: ignored (end of life, was needs-triage) | 35 | mantic_python-scrapy: ignored (end of life, was needs-triage) |
| 251 | 34 | noble_python-scrapy: not-affected (2.11.1-1) | 36 | noble_python-scrapy: not-affected (2.11.1-1) |
| 252 | 35 | esm-apps/noble_python-scrapy: not-affected (2.11.1-1) | 37 | esm-apps/noble_python-scrapy: not-affected (2.11.1-1) |
test infra is failing but the commit is Ok as i saw.