Поиск уязвимостей
Количество 7
Количество 7
CVE-2023-35934
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; hav...
CVE-2023-35934
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; havi
CVE-2023-35934
yt-dlp is a command-line program to download videos from video sites. ...
GHSA-v8mc-9377-rwjj
yt-dlp File Downloader cookie leak
openSUSE-SU-2023:0374-1
Security update for yt-dlp
ALT-PU-2023-8428
ALT-PU-2023-8428: package `yt-dlp` update to version 2023.09.24-alt1
ALT-PU-2024-13204
ALT-PU-2024-13204: package `yt-dlp` update to version 2024.08.06-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2023-35934 yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; hav... | CVSS3: 8.2 | 1% Низкий | больше 3 лет назад |
 | CVE-2023-35934 yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; havi | CVSS3: 8.2 | 1% Низкий | больше 3 лет назад |
| CVE-2023-35934 yt-dlp is a command-line program to download videos from video sites. ... | CVSS3: 8.2 | 1% Низкий | больше 3 лет назад |
| GHSA-v8mc-9377-rwjj yt-dlp File Downloader cookie leak | CVSS3: 6.1 | 1% Низкий | больше 3 лет назад |
 | openSUSE-SU-2023:0374-1 Security update for yt-dlp | почти 3 года назад | ||
| ALT-PU-2023-8428 ALT-PU-2023-8428: package `yt-dlp` update to version 2023.09.24-alt1 | CVSS3: 8.3 | больше 2 лет назад | |
| ALT-PU-2024-13204 ALT-PU-2024-13204: package `yt-dlp` update to version 2024.08.06-alt1 | CVSS3: 9.8 | около 2 лет назад |
Уязвимостей на страницу