CVE-2022-0577

Advisory

Scrapy versions 1.8.2 and 2.6.0 include a fix for CVE-2022-0577: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
https://github.com/advisories/GHSA-cjvr-mfj7-j4j8

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. See CVE-2022-0577.


CONFIRM:https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585: https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585
MISC:https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a: https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a
MLIST:[debian-lts-announce] 20220316 [SECURITY] [DLA 2950-1] python-scrapy security update: https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html

Resources

• https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585
• https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a
• https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0577