ALT-PU-2024-13204: package yt-dlp update to version 2024.08.06-alt1
Описание
This update upgrades yt-dlp to version 2024.08.06-alt1.
Устраненные уязвимости6
Ссылки5
GHSA-3ch3-jhc6-5r8x
https://github.com/advisories/GHSA-3ch3-jhc6-5r8xGHSA-42h4-v29r-42qg
https://github.com/advisories/GHSA-42h4-v29r-42qgGHSA-hjq6-52gw-2g7p
https://github.com/advisories/GHSA-hjq6-52gw-2g7pGHSA-v8mc-9377-rwjj
https://github.com/advisories/GHSA-v8mc-9377-rwjjСвязанные уязвимости
ALT-PU-2023-8428: package `yt-dlp` update to version 2023.09.24-alt1
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; hav...
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; havi
yt-dlp is a command-line program to download videos from video sites. ...