CVE-2024-38519

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-38519
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38519.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38519
Aliases
Published
2024-07-02T14:15:13Z
Modified
2024-07-08T18:29:12.366536Z
Summary
[none]
Details

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since yt-dlp and youtube-dl also read config from the working directory (and on Windows executables will be executed from the yt-dlp or youtube-dl directory), this could lead to arbitrary code being executed.

yt-dlp version 2024.07.01 fixes this issue by whitelisting the allowed extensions. youtube-dl fixes this issue in commit d42a222 on the master branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have .%(ext)s at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, system32, or other binaries locations. For users who are not able to upgrade, keep the default output template (-o "%(title)s [%(id)s].%(ext)s); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use --ignore-config --config-location ... to not load config from common locations.

References

Affected packages

Debian:12 / yt-dlp

Package

Name
yt-dlp
Purl
pkg:deb/debian/yt-dlp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2023.*

2023.03.04-1
2023.06.21-1
2023.06.22-1~bpo12+1
2023.06.22-1
2023.07.06-1~bpo12+1
2023.07.06-1
2023.09.24-1
2023.09.24-2~bpo12+1
2023.09.24-2
2023.10.07-1~bpo12+1
2023.10.07-1
2023.10.13-1~bpo11+1
2023.10.13-1~bpo12+1
2023.10.13-1
2023.11.16-1~bpo11+1
2023.11.16-1~bpo12+1
2023.11.16-1
2023.12.30-1

2024.*

2024.03.10-1~bpo12+1
2024.03.10-1
2024.04.09-1~bpo12+1
2024.04.09-1
2024.05.26-1~bpo12+1
2024.05.26-1
2024.05.27-1~bpo12+1
2024.05.27-1
2024.07.01-1
2024.07.02-1~bpo12+1
2024.07.02-1
2024.07.07-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / yt-dlp

Package

Name
yt-dlp
Purl
pkg:deb/debian/yt-dlp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2024.07.01-1

Affected versions

2023.*

2023.03.04-1
2023.06.21-1
2023.06.22-1~bpo12+1
2023.06.22-1
2023.07.06-1~bpo12+1
2023.07.06-1
2023.09.24-1
2023.09.24-2~bpo12+1
2023.09.24-2
2023.10.07-1~bpo12+1
2023.10.07-1
2023.10.13-1~bpo11+1
2023.10.13-1~bpo12+1
2023.10.13-1
2023.11.16-1~bpo11+1
2023.11.16-1~bpo12+1
2023.11.16-1
2023.12.30-1

2024.*

2024.03.10-1~bpo12+1
2024.03.10-1
2024.04.09-1~bpo12+1
2024.04.09-1
2024.05.26-1~bpo12+1
2024.05.26-1
2024.05.27-1~bpo12+1
2024.05.27-1

Ecosystem specific

{
    "urgency": "unimportant"
}