{"answers":{"affected":"4 open source packages ship an affected version, including scrapy.","exploited":"There is no known exploitation of GHSA-9x8m-2xpf-crp3 in the wild and no public exploit code.","fix":"Upgrade scrapy to a fixed version for your release line: 1.8.3 or 2.6.2.","what":"GHSA-9x8m-2xpf-crp3 is a vulnerability in scrapy, published on 29 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-9x8m-2xpf-crp3 and fix it if it is affected.\n\nWhat it is: GHSA-9x8m-2xpf-crp3 is a vulnerability in scrapy, published on 29 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-9x8m-2xpf-crp3 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- scrapy (PyPI): affected all versions; fixed in 1.8.3\n- scrapy (PyPI): affected all versions; fixed in 1.8.3\n- scrapy (PyPI): affected from 2.0.0; fixed in 2.6.2\n- scrapy (PyPI): affected from 2.0.0; fixed in 2.6.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9x8m-2xpf-crp3/ (Markdown: https://insights.sbomify.com/GHSA-9x8m-2xpf-crp3/index.md)","id":"GHSA-9x8m-2xpf-crp3","markdown":"https://insights.sbomify.com/GHSA-9x8m-2xpf-crp3/index.md","name":"GHSA-9x8m-2xpf-crp3","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Python web scraping library","requires_auth":"none","summary":"Scrapy leaks proxy credentials to different proxies during rotation, exposing sensitive authentication data to unintended third parties.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nWhen the [built-in HTTP proxy downloader middleware](https://docs.scrapy.org/en/2.6/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpproxy) processes a request with `proxy` metadata, and that `proxy` metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the `Proxy-Authentication` header, but only if that header is not already set.\n\nThere are third-party proxy-rotation downloader middlewares that set different `proxy` metadata every time they process a request.\n\nBecause of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.\n\nThese third-party proxy-rotation downloader middlewares could change the `proxy` metadata of a request to a new value, but fail to remove the `Proxy-Authentication` header from the previous value of the `proxy` metadata, causing the credentials of one proxy to be leaked to a different proxy.\n\nIf you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under **Workarounds** below. If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough; patching that downloader middlware may be necessary as well.\n\n### Patches\n\nUpgrade to Scrapy 2.6.2.\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.2 is not an option, you may upgrade to Scrapy 1.8.3 instead.\n\n### Workarounds\n\nIf you cannot upgrade, make sure that any code that changes the value of the `proxy` request meta also removes the `Proxy-Authorization` header from the request if present.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy/scrapy/issues)\n* [Email us](mailto:opensource@zyte.com)","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another","id":"GHSA-9x8m-2xpf-crp3","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"information_disclosure","year":"2022"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["1.8.3"],"introduced":["0"],"last_affected":[],"package":"scrapy","purl":null,"source":"GHSA-9x8m-2xpf-crp3"},{"ecosystem":"PyPI","fixed":["1.8.3"],"introduced":["0"],"last_affected":[],"package":"scrapy","purl":"pkg:pypi/scrapy","source":"GHSA-9x8m-2xpf-crp3"},{"ecosystem":"PyPI","fixed":["2.6.2"],"introduced":["2.0.0"],"last_affected":[],"package":"scrapy","purl":null,"source":"GHSA-9x8m-2xpf-crp3"},{"ecosystem":"PyPI","fixed":["2.6.2"],"introduced":["2.0.0"],"last_affected":[],"package":"scrapy","purl":"pkg:pypi/scrapy","source":"GHSA-9x8m-2xpf-crp3"}],"products":null,"published":"2022-07-29","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Scrapy leaks proxy credentials to different proxies during rotation, exposing sensitive authentication data to unintended third parties.","url":"https://insights.sbomify.com/GHSA-9x8m-2xpf-crp3/"}