CVE-2022-0577

Name	CVE-2022-0577
Description	Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-2950-1
Debian Bugs	1008234

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-scrapy (PTS)	stretch	1.0.3-2	vulnerable
	stretch (security)	1.0.3-2+deb9u1	fixed
	buster	1.5.1-1	vulnerable
	bullseye	2.4.1-2	vulnerable
	bookworm, sid	2.6.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-scrapy	source	stretch	1.0.3-2+deb9u1		DLA-2950-1
python-scrapy	source	(unstable)	2.6.1-1			1008234

Notes

[bullseye] - python-scrapy <no-dsa> (Minor issue)
[buster] - python-scrapy <no-dsa> (Minor issue)
https://github.com/advisories/GHSA-cjvr-mfj7-j4j8
https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585
https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a