Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/yt-dlp@2022.10.4
Typepypi
Namespace
Nameyt-dlp
Version2022.10.4
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2023.1.2
Latest_non_vulnerable_version2026.2.21
Affected_by_vulnerabilities
0
url VCID-q8ma-vk9z-yqh8
vulnerability_id VCID-q8ma-vk9z-yqh8
summary 
yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.
references
0
reference_url https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb
reference_id
reference_type
scores
url https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb
1
reference_url https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14
reference_id
reference_type
scores
url https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-46121
reference_id CVE-2023-46121
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-46121
3
reference_url https://github.com/advisories/GHSA-3ch3-jhc6-5r8x
reference_id GHSA-3ch3-jhc6-5r8x
reference_type
scores
url https://github.com/advisories/GHSA-3ch3-jhc6-5r8x
4
reference_url https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x
reference_id GHSA-3ch3-jhc6-5r8x
reference_type
scores
url https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x
fixed_packages
0
url pkg:pypi/yt-dlp@2023.11.14
purl pkg:pypi/yt-dlp@2023.11.14
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/yt-dlp@2023.11.14
aliases CVE-2023-46121, GHSA-3ch3-jhc6-5r8x
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-q8ma-vk9z-yqh8
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/yt-dlp@2022.10.4