CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

What is CVE-2024-1892?

CVE-2024-1892 is a high-severity denial of service vulnerability in scrapy/scrapy, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.

Weakness: CWE-1333

Which versions are affected by CVE-2024-1892?

5 open source packages ship an affected version, including scrapy. It affects 1 product.

Products include Scrapy Scrapy.

How do I fix CVE-2024-1892?

Upgrade scrapy to a fixed version for your release line: 1.8.4 or 2.11.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-1892 being exploited?

There is no known exploitation of CVE-2024-1892 in the wild and no public exploit code.

Other vulnerabilities in scrapy/scrapy

• CVE-2024-1968 Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects High 7.5
• CVE-2024-3572 XML External Entity (XXE) Vulnerability in scrapy/scrapy High 7.5
• CVE-2024-3574 Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy High 7.5
• CVE-2017-14158 Scrapy denial of service vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-1892, GHSA-cc65-xxvf-f7r9, PYSEC-2024-162, UBUNTU-CVE-2024-1892, openSUSE-SU-2024:13802-1.