[GHSA-cjvr-mfj7-j4j8] Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy - #9619
Conversation
|
Hi there @Gallaecio! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The corrected boundary matches the advisory text and the verified Scrapy 2.6.0 commit history.
Review effort: Balanced
Findings: None
What changed in this PR
Corrects the Scrapy advisory so OSV consumers no longer classify version 2.6.0 as vulnerable.
Changes:
- Changes the 2.x fixed version from 2.6.1 to 2.6.0.
- Removes redundant affected-range metadata and updates the modification timestamp.
| File | Description |
|---|---|
advisories/github-reviewed/2022/03/GHSA-cjvr-mfj7-j4j8/GHSA-cjvr-mfj7-j4j8.json |
Corrects the affected range to match the release containing the security fix. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
cc @AdrianAtZyte, @wRAR |
Updates
Comments
The first patched version of the 2.x entry should be 2.6.0, not 2.6.1. The advisory text already says "Upgrade to Scrapy 2.6.0".
The fix commit linked in the advisory is scrapy/scrapy@8ce01b3 ("Merge pull request from GHSA-cjvr-mfj7-j4j8"). Tag 2.6.0 contains it and tag 2.5.1 does not.
Version 2.6.1 came out the same day and only fixes a regression from 2.6.0 that unset the request method when following redirects: https://docs.scrapy.org/en/latest/news.html#scrapy-2-6-1-2022-03-01
The OSV export takes the fixed version from the first patched version, so version 2.6.0 is reported as vulnerable even though it has the fix.