PT-2021-23108 · Scrapy+2 · Scrapy+2

Gallaecio · Published 2021-10-06 · Updated 2025-05-05 · CVE-2021-41125

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.5.1 Scrapy versions 1.8 and earlier

Description The issue affects Scrapy when using HttpAuthMiddleware for HTTP authentication, causing all requests to expose credentials to the request target. This includes requests generated by Scrapy components, such as robots.txt requests or requests reached through redirects.

Recommendations For Scrapy versions prior to 2.5.1, upgrade to Scrapy 2.5.1 and use the new http auth domain spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials. For Scrapy versions 1.8 and earlier, upgrade to Scrapy 1.8.1 if upgrading to Scrapy 2.5.1 is not an option. If upgrading is not possible, set HTTP authentication credentials on a per-request basis using the w3lib.http.basic auth header function to convert credentials into a value that can be assigned to the Authorization header of the request.

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

CVE-2021-41125

DLA-2950-1

GHSA-JWQP-28GF-P498

OPENSUSE-SU-2024:11558-1

PYSEC-2021-363

USN-7476-1

Affected Products

Linuxmint

Scrapy

Ubuntu

References · 26

• https://github.com/scrapy/scrapy/commit/b01d69a1bf48060daec8f751368622352d8b85a6 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-41125 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41125 · Security Note
• https://ubuntu.com/security/CVE-2024-3572 · Vendor Advisory
• http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2950-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3574 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7476-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41125 · Security Note
• https://ubuntu.com/security/CVE-2021-41125 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11558-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1892 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41125 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0577 · Vendor Advisory