CVE-2017-14158: Denial of Service Vulnerability in Scrapy
Summary
CVE-2017-14158: Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually... Affects scrapy versions >= 0.7. No fix is published. How to fix ↓
Also tracked for
- python-scrapy · Debian:11
The same CVE-2017-14158 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scrapy is a Python framework used for web scraping and crawling. It provides a set of tools and libraries to extract data from websites. Scrapy allows developers to build web spiders that can navigate through websites, extract data, and store it for further processing. This vulnerability affects Scrapy version 1.4 and earlier.
Vulnerability Detail
The vulnerability in Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) by exploiting the way large files are handled. When processing large files, Scrapy reads them into memory, which becomes problematic if the files are then individually written to a slow storage resource in a separate thread. This can lead to excessive memory consumption and potentially crash the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately possible, a workaround is to limit the size of the files being processed by Scrapy. This can be achieved by setting a maximum file size limit in the Scrapy settings. Here is an example of how to set the maximum file size limit to 10MB:
settings.py
FILES_STORE_MAX_SIZE = 10485760
Conclusion
The vulnerability in Scrapy 1.4 allows remote attackers to cause a denial of service by exploiting the way large files are handled. It is recommended to upgrade to Scrapy version 1.4.1 or later to fix this issue. If immediate upgrade is not possible, setting a maximum file size limit can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for scrapy →
FAQ
Scrapy is a Python framework used for web scraping and crawling. It provides a set of tools and libraries to extract data from websites.
This vulnerability can cause a denial of service by consuming excessive memory, potentially leading to system crashes.
Scrapy version 1.4 and earlier are affected by this vulnerability.
To fix this vulnerability, upgrade to Scrapy version 1.4.1 or later by running 'pip install --upgrade scrapy'.
Yes, you can set a maximum file size limit in the Scrapy settings to mitigate the vulnerability. See the 'workaround' section for more details.
Related vulnerabilities
Recent vulnerabilities recorded for scrapy.
