PT-2017-13286 · Scrapy+1 · Scrapy+1

Kmike + 1 · Published 2017-09-05 · Updated 2022-05-17 · CVE-2017-14158

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Scrapy version 1.4

Description The issue allows remote attackers to cause a denial of service due to memory consumption via large files. This occurs because the software reads arbitrarily many files into memory. This problem is especially significant if the files are then individually written in a separate thread to a slow storage resource. The interaction between dataReceived in core/downloader/handlers/http11.py and S3FilesStore demonstrates this issue.

Recommendations For Scrapy version 1.4, consider restricting the size of files that can be read into memory to prevent excessive memory consumption. As a temporary workaround, consider implementing a mechanism to limit the number of files that can be processed simultaneously to minimize the risk of denial of service.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2017-14158

GHSA-H7WM-PH43-C39P

PYSEC-2017-83

Affected Products

Debian

Scrapy

References · 15

• 🔥 http://blog.csdn.net/wangtua/article/details/75228728 · Exploit
• https://cve.org/CVERecord?id=CVE-2017-14158 · Security Note
• https://ubuntu.com/security/CVE-2017-14158 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14158 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7wm-ph43-c39p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14158 · Security Note
• https://osv.dev/vulnerability/PYSEC-2017-83 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14158 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14158 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-14158 · Vendor Advisory
• https://github.com/scrapy/scrapy · Note
• https://github.com/scrapy/scrapy/issues/482 · Note
• https://github.com/pypa/advisory-database/blob/8b7a4d62a95e8f605e5dfb4e0b4f299e6403dc12/vulns/scrapy/PYSEC-2017-83.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2017-83.yaml · Note
• https://github.com/advisories/GHSA-h7wm-ph43-c39p · Note