[Python-modules-team] Bug#875947: python-scrapy: CVE-2017-14158

[Salvatore Bonaccorso]

Source: python-scrapy
Version: 1.4.0-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/scrapy/scrapy/issues/482

Hi,

the following vulnerability was published for python-scrapy.

CVE-2017-14158[0]:
| Scrapy 1.4 allows remote attackers to cause a denial of service (memory
| consumption) via large files because arbitrarily many files are read
| into memory, which is especially problematic if the files are then
| individually written in a separate thread to a slow storage resource,
| as demonstrated by interaction between dataReceived (in
| core/downloader/handlers/http11.py) and S3FilesStore.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-14158
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14158
[1] https://github.com/scrapy/scrapy/issues/482

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore