Scrapy 信息泄露漏洞

漏洞信息详情

Scrapy是一个用Python编写的自由且开源的网络爬虫框架。

Scrapy 存在信息泄露漏洞，如果您使用HttpAuthMiddleware（即http_user和http_pass属性）进行HTTP 身份验证，则所有请求都将向请求目标公开您的凭据。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/scrapy/scrapy/security/advisories/GHSA-jwqp-28gf-p498

来源:CONFIRM

链接:https://github.com/scrapy/scrapy/security/advisories/GHSA-jwqp-28gf-p498

来源:httpauth

链接:httpauth

来源:MISC

链接:http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.

来源:MISC

链接:https://github.com/scrapy/scrapy/commit/b01d69a1bf48060daec8f751368622352d8b85a6

来源:http.basic_auth_header

链接:http.basic_auth_header

来源:MISC

链接:https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2021-41125

暂无