CVE-2017-14158: High severity scrapy vulnerability
Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14158?
CVE-2017-14158 is categorized as a denial of service vulnerability due to memory consumption issues.
How do I fix CVE-2017-14158?
To remediate CVE-2017-14158, you should update Scrapy to a version that is newer than 1.4 that addresses memory management.
What are the potential impacts of CVE-2017-14158?
The potential impacts of CVE-2017-14158 include degraded performance and application crashes due to excessive memory consumption.
Which versions of Scrapy are affected by CVE-2017-14158?
CVE-2017-14158 specifically affects Scrapy version 1.4.
Can CVE-2017-14158 be exploited remotely?
Yes, CVE-2017-14158 can be exploited by remote attackers through the upload of large files.