Vulnerable Library - Scrapy-2.6.0-py2.py3-none-any.whl
A high-level Web Crawling and Web Scraping framework
Library home page: https://files.pythonhosted.org/packages/89/47/10c1197316233761afb5522d48a8e27f65389044ddda58d91d0eaeaecd20/Scrapy-2.6.0-py2.py3-none-any.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Vulnerabilities
| CVE |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (Scrapy version) |
Remediation Possible** |
| WS-2022-0365 |
 Critical |
9.8 |
cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl |
Transitive |
N/A* |
❌ |
| CVE-2023-38325 |
 High |
7.5 |
cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl |
Transitive |
N/A* |
❌ |
| CVE-2023-49083 |
High |
7.5 |
cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl |
Transitive |
N/A* |
❌ |
| CVE-2023-0286 |
High |
7.4 |
cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl |
Transitive |
N/A* |
❌ |
| CVE-2023-23931 |
 Medium |
6.5 |
cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl |
Transitive |
N/A* |
❌ |
| WS-2022-0181 |
Medium |
5.3 |
Scrapy-2.6.0-py2.py3-none-any.whl |
Direct |
Scrapy - 1.8.3,2.6.2 |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
WS-2022-0365
Vulnerable Library - cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/e9/4e/25616a4514d81d4940afcf681e196a3d6dffaaddc0034a7d5dd1c490a864/cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Dependency Hierarchy:
- Scrapy-2.6.0-py2.py3-none-any.whl (Root Library)
- ❌ cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Publish Date: 2022-11-02
URL: WS-2022-0365
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-39hc-v87j-747x
Release Date: 2022-11-02
Fix Resolution: cryptography - 38.0.3
Step up your Open Source Security Game with Mend here
CVE-2023-38325
Vulnerable Library - cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/e9/4e/25616a4514d81d4940afcf681e196a3d6dffaaddc0034a7d5dd1c490a864/cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Dependency Hierarchy:
- Scrapy-2.6.0-py2.py3-none-any.whl (Root Library)
- ❌ cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
Publish Date: 2023-07-14
URL: CVE-2023-38325
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-38325
Release Date: 2023-07-14
Fix Resolution: cryptography - 41.0.2
Step up your Open Source Security Game with Mend here
CVE-2023-49083
Vulnerable Library - cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/e9/4e/25616a4514d81d4940afcf681e196a3d6dffaaddc0034a7d5dd1c490a864/cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Dependency Hierarchy:
- Scrapy-2.6.0-py2.py3-none-any.whl (Root Library)
- ❌ cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Publish Date: 2023-11-29
URL: CVE-2023-49083
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-49083
Release Date: 2023-11-29
Fix Resolution: cryptography - 41.0.6
Step up your Open Source Security Game with Mend here
CVE-2023-0286
Vulnerable Library - cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/e9/4e/25616a4514d81d4940afcf681e196a3d6dffaaddc0034a7d5dd1c490a864/cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Dependency Hierarchy:
- Scrapy-2.6.0-py2.py3-none-any.whl (Root Library)
- ❌ cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
Publish Date: 2023-02-08
URL: CVE-2023-0286
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-x4qr-2fvf-3mr5
Release Date: 2023-02-08
Fix Resolution: openssl-3.0.8;cryptography - 39.0.1;openssl-src - 111.25.0+1.1.1t,300.0.12+3.0.8
Step up your Open Source Security Game with Mend here
CVE-2023-23931
Vulnerable Library - cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/e9/4e/25616a4514d81d4940afcf681e196a3d6dffaaddc0034a7d5dd1c490a864/cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Dependency Hierarchy:
- Scrapy-2.6.0-py2.py3-none-any.whl (Root Library)
- ❌ cryptography-38.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.
Publish Date: 2023-02-07
URL: CVE-2023-23931
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-23931
Release Date: 2023-02-07
Fix Resolution: cryptography - 39.0.1
Step up your Open Source Security Game with Mend here
WS-2022-0181
Vulnerable Library - Scrapy-2.6.0-py2.py3-none-any.whl
A high-level Web Crawling and Web Scraping framework
Library home page: https://files.pythonhosted.org/packages/89/47/10c1197316233761afb5522d48a8e27f65389044ddda58d91d0eaeaecd20/Scrapy-2.6.0-py2.py3-none-any.whl
Path to dependency file: /ci/requirements.txt
Path to vulnerable library: /ci/requirements.txt
Dependency Hierarchy:
- ❌ Scrapy-2.6.0-py2.py3-none-any.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
Scrapy before v2.6.2 and v1.8.3 vulnerable to one proxy sending credentials to another
Publish Date: 2022-07-29
URL: WS-2022-0181
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-9x8m-2xpf-crp3
Release Date: 2022-07-29
Fix Resolution: Scrapy - 1.8.3,2.6.2
Step up your Open Source Security Game with Mend here
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent