rpm package
opensuse/yt-dlp&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/yt-dlp&distro=openSUSE%20Tumbleweed
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-38519 | Hig | 7.8 | < 2024.07.01-1.1 | 2024.07.01-1.1 | Jul 2, 2024 | `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows) | |
| CVE-2024-22423 | — | < 2024.04.09-1.1 | 2024.04.09-1.1 | Apr 9, 2024 | yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion o | ||
| CVE-2023-46121 | — | < 2023.11.16-1.1 | 2023.11.16-1.1 | Nov 14, 2023 | yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to | ||
| CVE-2023-35934 | — | < 2023.07.06-1.1 | 2023.07.06-1.1 | Jul 6, 2023 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent |
- affected < 2024.07.01-1.1fixed 2024.07.01-1.1
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows)
- CVE-2024-22423Apr 9, 2024affected < 2024.04.09-1.1fixed 2024.04.09-1.1
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion o
- CVE-2023-46121Nov 14, 2023affected < 2023.11.16-1.1fixed 2023.11.16-1.1
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to
- CVE-2023-35934Jul 6, 2023affected < 2023.07.06-1.1fixed 2023.07.06-1.1
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent