{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15547?format=json","vulnerability_id":"VCID-8wu8-qh8m-7ubm","summary":"Duplicate Advisory: ReDos vulnerability of XMLFeedSpider\n## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cc65-xxvf-f7r9. This link is maintained to preserve external references.\n\n## Original Description\nParts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.","aliases":[{"alias":"GHSA-7c9g-vj9m-8pm6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/45161?format=json","purl":"pkg:pypi/scrapy@1.8.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1k4b-pr5k-s7e5"},{"vulnerability":"VCID-64nx-aruy-q7gy"},{"vulnerability":"VCID-dc1m-rt7j-w3af"},{"vulnerability":"VCID-nekz-z7zw-mfgz"},{"vulnerability":"VCID-t5cn-a543-nyag"},{"vulnerability":"VCID-urb1-hv1z-duga"},{"vulnerability":"VCID-veaw-n6vt-zfgu"},{"vulnerability":"VCID-x9ee-za9y-3fcb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/scrapy@1.8.4"},{"url":"http://public2.vulnerablecode.io/api/packages/45174?format=json","purl":"pkg:pypi/scrapy@2.11.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1k4b-pr5k-s7e5"},{"vulnerability":"VCID-dc1m-rt7j-w3af"},{"vulnerability":"VCID-nekz-z7zw-mfgz"},{"vulnerability":"VCID-t5cn-a543-nyag"},{"vulnerability":"VCID-urb1-hv1z-duga"},{"vulnerability":"VCID-veaw-n6vt-zfgu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/scrapy@2.11.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62553?format=json","purl":"pkg:pypi/scrapy@2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-64nx-aruy-q7gy"},{"vulnerability":"VCID-8wu8-qh8m-7ubm"},{"vulnerability":"VCID-kgf5-wu3r-pqc6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/scrapy@2"}],"references":[{"reference_url":"https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5"},{"reference_url":"https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1892","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1892"},{"reference_url":"https://github.com/advisories/GHSA-7c9g-vj9m-8pm6","reference_id":"GHSA-7c9g-vj9m-8pm6","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7c9g-vj9m-8pm6"}],"weaknesses":[{"cwe_id":1333,"name":"Inefficient Regular Expression Complexity","description":"The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles."}],"exploits":[],"severity_range_score":"7.0 - 8.9","exploitability":"0.5","weighted_severity":"8.0","risk_score":4.0,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8wu8-qh8m-7ubm"}