The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0374-1 advisory.

  - yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the     external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak     them when the host for download fragments differs from their parent manifest's host. This vulnerable     behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external     downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download     stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their     scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result,     the downloader or external tool may indiscriminately send cookies with requests to domains or paths for     which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue     by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie`     header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing     them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper     cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate     field for cookies in the info dict storing more information about scoping Some workarounds are available     for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors     may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using     `--load-info-json`. Or, if authentication is a must: verify the integrity of download links from unknown     sources in browser (including redirects) before passing them to yt-dlp; use `curl` as external downloader,     since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.
    (CVE-2023-35934)

  - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is     vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the     attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in     some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as     well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade     should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution     when using `--no-check-certificate`. (CVE-2023-46121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

openSUSE 15 Security Update : yt-dlp (openSUSE-SU-2023:0374-1)

high Nessus Plugin ID 185986

Version 1.0