yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie` header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using `--load-info-json`. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use `curl` as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

The remote host is affected by the vulnerability described in GLSA-202409-30 (yt-dlp: Multiple Vulnerabilities)

    Multiple vulnerabilities have been found in yt-dlp. Please review the referenced CVE identifiers for     details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0374-1 advisory.

  - yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the     external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak     them when the host for download fragments differs from their parent manifest's host. This vulnerable     behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external     downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download     stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their     scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result,     the downloader or external tool may indiscriminately send cookies with requests to domains or paths for     which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue     by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie`     header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing     them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper     cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate     field for cookies in the info dict storing more information about scoping Some workarounds are available     for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors     may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using     `--load-info-json`. Or, if authentication is a must: verify the integrity of download links from unknown     sources in browser (including redirects) before passing them to yt-dlp; use `curl` as external downloader,     since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.
    (CVE-2023-35934)

  - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is     vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the     attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in     some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as     well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade     should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution     when using `--no-check-certificate`. (CVE-2023-46121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-5435c10480 advisory.

    Update to latest upstream git snapshot. Various changes, including bug fix for cookie leak vulnerability.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1f11546a48 advisory.

    Update to latest upstream git snapshot.
    Various changes, including bug fix for cookie leak vulnerability.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-79e2b35ba6 advisory.


    Update to 2023.07.06.

    Mitigates CVE-2023-35934 / GHSA-v8mc-9377-rwjj.

    ----

    Update to 2023.06.22. Fixes rhbz#2216612.

    ----

    Update to 2023.06.21. Fixes rhbz#2216612.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9f3938e10d advisory.


    Update to 2023.07.06.

    Mitigates CVE-2023-35934 / GHSA-v8mc-9377-rwjj

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207891	GLSA-202409-30 : yt-dlp: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
185986	openSUSE 15 Security Update : yt-dlp (openSUSE-SU-2023:0374-1)	Nessus	SuSE Local Security Checks	high
180185	Fedora 37 : youtube-dl (2023-5435c10480)	Nessus	Fedora Local Security Checks	high
180183	Fedora 38 : youtube-dl (2023-1f11546a48)	Nessus	Fedora Local Security Checks	high
178178	Fedora 37 : yt-dlp (2023-79e2b35ba6)	Nessus	Fedora Local Security Checks	high
178054	Fedora 38 : yt-dlp (2023-9f3938e10d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-35934

high

Tenable Plugins

high

high

high

high

high

high