{"id":"GHSA-mfjm-vh54-3f96","aliases":[],"url":"https://o3.security/vulnerability/GHSA-mfjm-vh54-3f96","summary":"Scrapy cookie-setting is not restricted based on the public suffix list","details":"### Impact\n\nResponses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.\n\n### Patches\n\nUpgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the [public suffix list](https://publicsuffix.org/).\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.\n\n### Workarounds\n\nThe only workaround for unpatched versions of Scrapy is to [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).\n\n### References\n* https://publicsuffix.org/\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy/scrapy/issues)\n* [Email us](mailto:opensource@zyte.com)\n","published":"2022-03-01T22:13:28Z","modified":"2024-12-07T05:40:29.120017Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"scrapy","fixedVersion":"1.8.2"},{"ecosystem":"PyPI","name":"scrapy","fixedVersion":"2.6.0"}],"fix":{"url":"https://github.com/scrapy/scrapy/commit/e865c4430e58a4faa0e0766b23830f8423d6167a","label":"scrapy/scrapy@e865c44"},"references":[{"type":"WEB","url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-mfjm-vh54-3f96"},{"type":"WEB","url":"https://github.com/scrapy/scrapy/commit/e865c4430e58a4faa0e0766b23830f8423d6167a"},{"type":"PACKAGE","url":"https://github.com/scrapy/scrapy"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-07T05:40:29.120017Z"}}