- Package:
- release.debian.org
- Source:
- release.debian.org
- Submitter:
- Stefano Rivera
- Date:
- 2022-07-09 10:52:37 UTC
- Severity:
- normal
- Tags:
[ Reason ] Hi, there were some security issues in python-scrapy, that were deemed no-DSA [ Impact ] Known security issues, with the risk of credential-exposure. [ Tests ] They both include unit tests, which pass. [ Risks ] There are behavioural changes, that could affect users of this code, if they are scraping sites that need authentication. However, this is unavoidable for the issues being fixed. This matches what was uploaded to stretch-security, although the patch isn't identical. So, anyone upgrading from stretch-lts would hit a regression if this wasn't updated. Risks both ways. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] * Security fix for CVE-2021-41125: Don't send authentication data with all requests. Provide a http_auth_domain spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials. * Security Fix CVE-2022-0577: Don't expose cookies cross-domain when redirected. (Closes: #1008234)
package release.debian.org tags 1011359 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details ============== Package: python-scrapy Version: 2.4.1-2+deb11u1 Explanation: don't send authentication data with all requests [CVE-2021-41125]; don't expose cookies cross-domain when redirecting [CVE-2022-0577]
package release.debian.org tags 1011359 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details ============== Package: python-scrapy Version: 2.4.1-2+deb11u1 Explanation: don't send authentication data with all requests [CVE-2021-41125]; don't expose cookies cross-domain when redirecting [CVE-2022-0577]
(re-sending with fixed bug numbers) Hi, The updates discussed in these bugs were included in today's bullseye point release. Regards, Adam