Denial of Service Vulnerability in Scrapy by Scrapinghub
CVE-2017-14158

7.5HIGH

Key Information:

Vendor

Scrapy

Status
Scrapy
Vendor
CVE Published:
5 September 2017

What is CVE-2017-14158?

Scrapy 1.4 is vulnerable to a denial of service attack due to its insufficient handling of large file uploads. Attackers can exploit this flaw by sending large files, which are read into memory without limits. This can lead to significant memory consumption, especially when files are processed in separate threads and written to slower storage solutions like Amazon S3. This vulnerability arises from the interaction between the dataReceived function and the S3FilesStore, allowing attackers to negatively impact the performance and availability of applications relying on Scrapy.

References

https://github.com/scrapy/scrapy/issues/482
x_refsource_MISC
http://blog.csdn.net/wangtua/article/details/75228728
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.