yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is
    vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the
    attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in
    some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as
    well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade
    should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution
    when using `--no-check-certificate`. (CVE-2023-46121)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is     vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the     attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in     some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as     well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade     should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution     when using `--no-check-certificate`. (CVE-2023-46121)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202409-30 (yt-dlp: Multiple Vulnerabilities)

    Multiple vulnerabilities have been found in yt-dlp. Please review the referenced CVE identifiers for     details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0374-1 advisory.

  - yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the     external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak     them when the host for download fragments differs from their parent manifest's host. This vulnerable     behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external     downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download     stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their     scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result,     the downloader or external tool may indiscriminately send cookies with requests to domains or paths for     which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue     by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie`     header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing     them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper     cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate     field for cookies in the info dict storing more information about scoping Some workarounds are available     for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors     may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using     `--load-info-json`. Or, if authentication is a must: verify the integrity of download links from unknown     sources in browser (including redirects) before passing them to yt-dlp; use `curl` as external downloader,     since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.
    (CVE-2023-35934)

  - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is     vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the     attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in     some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as     well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade     should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution     when using `--no-check-certificate`. (CVE-2023-46121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427120	Alpine: multiple yt-dlp packages: security update to 2023.11.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
427120	Alpine: multiple yt-dlp packages: security update to 2023.11.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
226687	Linux Distros Unpatched Vulnerability : CVE-2023-46121	Nessus	Misc.	low
409457	SCA: security update for yt-dlp (GHSA-3ch3-jhc6-5r8x)	Tenable Cloud Security	SCA Checks	low
409457	SCA: security update for yt-dlp (GHSA-3ch3-jhc6-5r8x)	Tenable Self-Hosted Container Security	SCA Checks	low
207891	GLSA-202409-30 : yt-dlp: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
185986	openSUSE 15 Security Update : yt-dlp (openSUSE-SU-2023:0374-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-46121

low

Tenable Plugins

low

low

low

low

low

high

high