CVE-2024-3574: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2024-04-16T00:15Z
Repository: https://github.com/scrapy/scrapy
Language: Other
Files changed: docs/news.rst
Commit date: 2024-02-14 17:14:29 +0100
Commit message: Merge branch '2.11-authorization' into 2.11

Diff: diff --cc docs/news.rst
index c26cef22c,ca303b924..5a3d5e783
--- a/docs/news.rst
+++ b/docs/news.rst
@@@ -3,66 -3,22 +3,78 @@@
  Release notes
  =============
  
  .. _release-2.11.1:
  
- Scrapy 2.11.1 (YYYY-MM-DD)
+ Scrapy 2.11.1 (unreleased)
  --------------------------
  
 -**Security bug fix:**
 +Highlights:
 +
++-   Security bug fixes.
++
 +-   Support for Twisted >= 23.8.0.
 +
 +-   Documentation improvements.
 +
++Security bug fixes
++~~~~~~~~~~~~~~~~~~
+ 
+ -   The ``Authorization`` header is now dropped on redirects to a different
+     domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
+     information.
+ 
+     .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
+ 
 +Modified requirements
 +~~~~~~~~~~~~~~~~~~~~~
 +
 +-   The Twisted dependency is no longer restricted to < 23.8.0. (:issue:`6024`,
 +    :issue:`6064`, :issue:`6142`)
 +
 +Bug fixes
 +~~~~~~~~~
 +
 +-   The OS signal handling code was refactored to no longer use private Twisted
 +    functions. (:issue:`6024`, :issue:`6064`, :issue:`6112`)
 +
 +Documentation
 +~~~~~~~~~~~~~
 +
 +-   Improved documentation for :class:`~scrapy.crawler.Crawler` initialization
 +    changes made in the 2.11.0 release. (:issue:`6057`, :issue:`6147`)
 +
 +-   Extended documentation for :attr:`Request.meta <scrapy.http.Request.meta>`.
 +    (:issue:`5565`)
 +
 +-   Fixed the :reqmeta:`dont_merge_cookies` documentation. (:issue:`5936`,
 +    :issue:`6077`)
 +
 +-   Added a link to Zyte's export guides to the :ref:`feed exports
 +    <topics-feed-exports>` documentation. (:issue:`6183`)
 +
 +-   Added a missing note about backward-incompatible changes in
 +    :class:`~scrapy.exporters.PythonItemExporter` to the 2.11.0 release notes.
 +    (:issue:`6060`, :issue:`6081`)
 +
 +-   Added a missing note about removing the deprecated
 +    ``scrapy.utils.boto.is_botocore()`` function to the 2.8.0 release notes.
 +    (:issue:`6056`, :issue:`6061`)
 +
 +-   Other documentation improvements. (:issue:`6128`, :issue:`6144`,
 +    :issue:`6163`, :issue:`6190`, :issue:`6192`)
 +
 +Quality assurance
 +~~~~~~~~~~~~~~~~~
 +
 +-   Added Python 3.12 to the CI configuration, re-enabled tests that were
 +    disabled when the pre-release support was added. (:issue:`5985`,
 +    :issue:`6083`, :issue:`6098`)
 +
 +-   Fixed a test issue on PyPy 7.3.14. (:issue:`6204`, :issue:`6205`)
 +
+ 
  .. _release-2.11.0:
  
  Scrapy 2.11.0 (2023-09-18)
  --------------------------
  
@@@ -2927,10 -2883,23 +2939,23 @@@ affect subclasses
      corresponding instances of
      :attr:`~scrapy.core.scheduler.DownloaderAwarePriorityQueue.downstream_queue_cls`.
  
  (:issue:`3884`)
  
+ .. _release-1.8.4:
+ 
+ Scrapy 1.8.4 (unreleased)
+ -------------------------
+ 
 -**Security bug fix:**
++**Security bug fixes:**
+ 
+ -   The ``Authorization`` header is now dropped on redirects to a different
+     domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
+     information.
+ 
+     .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
+ 
  
  .. _release-1.8.3:
  
  Scrapy 1.8.3 (2022-07-25)
  -------------------------

Vulnerable code:  Scrapy 2.11.1 (YYYY-MM-DD)
Fixed code:  Scrapy 2.11.1 (unreleased)
+-   Security bug fixes.
+
+Security bug fixes
+~~~~~~~~~~~~~~~~~~
 
 -   The ``Authorization`` header is now dropped on redirects to a different
     domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
     information.
 
     .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
 
 
 .. _release-1.8.4:
 
 Scrapy 1.8.4 (unreleased)
 -------------------------
 
+**Security bug fixes:**
 
 -   The ``Authorization`` header is now dropped on redirects to a different
     domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
     information.
 
     .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv