[GHSA-2qfp-q593-8484] Scrapy with Brotli is vulnerable to a denial of service (DoS) attack due to decompression #6424
Conversation
github-actions
bot
changed the base branch from
main
to
Cycloctane/advisory-improvement-6424
There was a problem hiding this comment.
Pull Request Overview
This PR updates security advisory GHSA-2qfp-q593-8484 to refocus it from Brotli to Scrapy as the primary affected package. The advisory describes a denial of service vulnerability in Scrapy's brotli decompression implementation.
- Refocused the advisory from Brotli to Scrapy as the primary affected package
- Updated version ranges to reflect that Scrapy 2.13.4 includes a fix
- Reorganized and cleaned up references to focus on Scrapy-specific resources
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
advisory-database
bot
merged commit 116c3fa
into
Cycloctane/advisory-improvement-6424
|
Hi @Cycloctane! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
|
Hi @Cycloctane, thanks for the update on scrapy/scrapy#7134 and the release of Scrapy 2.13.4. The changes to GHSA-2qfp-q593-8484 should be visible now. |
Updates
Comments
#6380 (comment)
#6380 (comment)