CVE-2023-46121

描述

yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.

如何修補 CVE-2023-46121

要修補 CVE-2023-46121,請將受影響套件升級到下列已修補版本。

• —升級至 2023.11.14 或更新版本
• —升級至 2023.11.14 或更新版本

CVE-2023-46121 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 2022.10.04, < 2023.11.14
• >= 2022.10.04, < 2023.11.14

CVSS 分數

參考連結(7)

• ADVISORYgithub.com/advisories/GHSA-3ch3-jhc6-5r8x
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-46121
• PATCHgithub.com/yt-dlp/yt-dlp
• PATCHpypi.org/project/yt-dlp
• WEBgithub.com