PT-2017-13286 · Scrapy+1 · Scrapy+1

Kmike + 1 · Publicado 2017-09-05 · Atualizado 2022-05-17 · CVE-2017-14158

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Scrapy version 1.4

Description The issue allows remote attackers to cause a denial of service due to memory consumption via large files. This occurs because the software reads arbitrarily many files into memory. This problem is especially significant if the files are then individually written in a separate thread to a slow storage resource. The interaction between dataReceived in core/downloader/handlers/http11.py and S3FilesStore demonstrates this issue.

Recommendations For Scrapy version 1.4, consider restricting the size of files that can be read into memory to prevent excessive memory consumption. As a temporary workaround, consider implementing a mechanism to limit the number of files that can be processed simultaneously to minimize the risk of denial of service.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2017-14158

GHSA-H7WM-PH43-C39P

PYSEC-2017-83

Produtos afetados

Debian

Scrapy

Referências · 15

• 🔥 http://blog.csdn.net/wangtua/article/details/75228728 · Exploit
• https://github.com/scrapy/scrapy · Nota
• https://github.com/scrapy/scrapy/issues/482 · Nota
• https://github.com/pypa/advisory-database/blob/8b7a4d62a95e8f605e5dfb4e0b4f299e6403dc12/vulns/scrapy/PYSEC-2017-83.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2017-83.yaml · Nota
• https://cve.org/CVERecord?id=CVE-2017-14158 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-14158 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14158 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h7wm-ph43-c39p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14158 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2017-83 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14158 · Aviso do Fabricante
• https://github.com/advisories/GHSA-h7wm-ph43-c39p · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14158 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-14158 · Aviso do Fabricante