CVE catalog

CVE-2024-1968

Scrapy vulnerabilities

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: May 20, 2024, 8:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.69% · Oct 25, 2026

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	python-scrapy	sid	`2.19.0-2`	fixed
Debian	python-scrapy	forky	`2.19.0-2`	fixed
Debian	python-scrapy	trixie	`2.12.0-2`	fixed
Debian	python-scrapy	bookworm	`2.8.0-2`	vulnerable
Ubuntu	python-scrapy	noble	Not reported	vulnerable
Ubuntu	python-scrapy	noble	`2.11.1-1ubuntu0.1~esm2`	fixed
Ubuntu	python-scrapy-doc	noble	`2.11.1-1ubuntu0.1~esm2`	fixed
Ubuntu	python3-scrapy	noble	`2.11.1-1ubuntu0.1~esm2`	fixed
Ubuntu	python-scrapy	16.04	`1.0.0-1`	vulnerable
Ubuntu	python-scrapy	16.04	`1.0.3-1`	vulnerable
Ubuntu	python-scrapy	pro	`2.10.0-1`	vulnerable
Ubuntu	python-scrapy	pro	`2.11.0-1`	vulnerable
Ubuntu	python-scrapy	pro	`2.11.0-2`	vulnerable
Ubuntu	python-scrapy	pro	`2.11.1-1`	vulnerable
Ubuntu	python-scrapy	pro	`2.11.1-1ubuntu0.1~esm2`	fixed
Opensuse	python-Scrapy	tumbleweed	`2.11.2-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	python-scrapy	source	sid	`2.11.2-1`	not yet assigned	Not reported	Not reported
Debian	python-scrapy	source	forky	`2.11.2-1`	not yet assigned	Not reported	Not reported
Debian	python-scrapy	source	trixie	`2.11.2-1`	not yet assigned	Not reported	Not reported
Debian	python-scrapy	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Ubuntu	python-scrapy	deb	noble	`2.11.1-1ubuntu0.1~esm2`	Not reported	Not reported	Not reported
Ubuntu	python-scrapy-doc	deb	noble	`2.11.1-1ubuntu0.1~esm2`	Not reported	Not reported	Not reported
Ubuntu	python3-scrapy	deb	noble	`2.11.1-1ubuntu0.1~esm2`	Not reported	Not reported	Not reported
Ubuntu	python-scrapy	deb	pro	`2.11.1-1ubuntu0.1~esm2`	Not reported	UBUNTU-CVE-2024-1968	Not reported
Opensuse	python-Scrapy	rpm	tumbleweed	`2.11.2-1.1`	Not reported	OPENSUSE-SU-2024:14130-1	Not reported

Notes

[bookworm] python-scrapy: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-scrapy]Affected
Source package: [python-scrapy]
Details (2)
- 2.8.0-2 · all · bookworm
  Affected
  usn · python-scrapy · debian · bookworm; usn · python-scrapy · debian · 12
- 2.8.0-2 · all · bookworm
  Affected
  usn · python-scrapy · debian · bookworm; usn · python-scrapy · debian · 12
[python-scrapy-doc]Affected
Source package: [python-scrapy]
Details (2)
- 2.8.0-2 · all · bookworm
  Affected
  usn · python-scrapy · debian · bookworm; usn · python-scrapy · debian · 12
- 2.8.0-2 · all · bookworm
  Affected
  usn · python-scrapy · debian · bookworm; usn · python-scrapy · debian · 12

[openSUSE Tumbleweed]

[python313-Scrapy]Unknown
Source package: [python-Scrapy]
Details (1)
- 2.17.0+git7-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2.11.2-1.1
  Version impact unknown
  usn · python-Scrapy · opensuse · tumbleweed
[python314-Scrapy]Unknown
Source package: [python-Scrapy]
Details (1)
- 2.17.0+git7-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2.11.2-1.1
  Version impact unknown
  usn · python-Scrapy · opensuse · tumbleweed
[python-Scrapy-doc]Unknown
Source package: [python-Scrapy]
Details (1)
- 2.17.0+git7-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2.11.2-1.1
  Version impact unknown
  usn · python-Scrapy · opensuse · tumbleweed

[Debian 13 (Trixie)]

[python3-scrapy]Fixed
Source package: [python-scrapy]
Details (2)
- 2.12.0-2 · all · trixie
  Fixed · Fixed: 2.11.2-1
  usn · python-scrapy · debian · 13
- 2.12.0-2 · all · trixie
  Fixed · Fixed: 2.11.2-1
  usn · python-scrapy · debian · 13
[python-scrapy-doc]Fixed
Source package: [python-scrapy]
Details (2)
- 2.12.0-2 · all · trixie
  Fixed · Fixed: 2.11.2-1
  usn · python-scrapy · debian · 13
- 2.12.0-2 · all · trixie
  Fixed · Fixed: 2.11.2-1
  usn · python-scrapy · debian · 13

Observed: Oct 27, 2026, 3:55:28 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]