CVE-2024-1892
Medium
Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
SeverityMedium
CVSS6.5
Exploit probability—
ProductScrapy
PublishedFeb 28, 2024
First seenFeb 28, 2024
Weakness typeCWE-1333CWE-1333
How to fix
Update
- scrapy scrapy2.11.1 or later
- scrapy2.11.1, 1.8.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scrapy scrapy | v < 2.11.1 | 2.11.1 |
| scrapyPyPI | 2 ≤ v < 2.11.1, v < 1.8.4, v < 2.11.1 | 2.11.1, 1.8.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.