{"id":"openSUSE-SU-2023:0374-1","summary":"Security update for yt-dlp","details":"This update for yt-dlp fixes the following issues:\n\n- Update to release 2023.11.14\n\n  * Security: [CVE-2023-46121] Patch Generic Extractor MITM\n    Vulnerability via Arbitrary Proxy Injection\n  * Disallow smuggling of arbitrary http_headers; extractors now\n    only use specific headers\n\n- Make yt-dlp require the one pythonXX-yt-dlp that /usr/bin/yt-dlp\n  was built with.\n\n- Rework Python build procedure [boo#1216467]\n- Enable Python library [boo#1216467]\n\n- Update to release 2023.10.13\n\n  * youtube: fix some bug with --extractor-retries inf\n\n- Update to release 2023.10.07\n\n  * yt: Fix heatmap extraction\n  * yt: Raise a warning for Incomplete Data instead of an error\n\n- Update to release 2023.09.24\n\n  * Extract subtitles from SMIL manifests\n  * fb: Add dash manifest URL\n  * crunchyroll: Remove initial state extraction\n  * youtube: Add player_params extractor arg\n\n- remove suggests on brotlicffi - this is only for != cpython\n\n- Update to release 2023.07.06\n\n  * Prevent Cookie leaks on HTTP redirect [boo#1213124] [CVE-2023-35934]\n  * yt: Avoid false DRM detection\n  * yt: Process post_live over 2 hours\n  * yt: Support shorts-only playlists\n\n- Update to release 2023.06.22\n\n   * youtube: add IOS to default clients used\n\n- Update to release 2023.06.21\n\n  * Add option --compat-option playlist-match-filter\n  * Add options --no-quiet, option --color, --netrc-cmd, --xff\n  * Auto-select default format in -f-\n  * Improve HTTP redirect handling\n  * Support decoding multiple content encodings\n\n- Use python3.11 on Leap 15.5\n\n  * python3.11 is the only python3 \u003e 3.6 version would be shipped\n    in Leap 15.5\n\n- Update to release 2023.03.04\n\n  * A bunch of extractor fixes\n\n- Update to release 2023.03.03\n\n  * youtube: Construct dash formats with range query\n  * yt: Detect and break on looping comments\n  * yt: Extract channel view_count when /about tab is passed\n\n- Update to release 2023.02.17\n\n  * Merge youtube-dl: Upto commit/2dd6c6e (Feb 17 2023)\n  * Fix --concat-playlist\n  * Imply --no-progress when --print\n  * Improve default subtitle language selection\n  * Make title completely non-fatal\n  * Sanitize formats before sorting\n  * [hls] Allow extractors to provide AES key\n  * [extractor/generic] Avoid catastrophic backtracking in KVS regex\n  * [jsinterp] Support if statements\n  * [plugins] Fix zip search paths\n  * [utils] Don't use Content-length with encoding\n  * [utils] Fix time_seconds to use the provided TZ\n  * [utils] Fix race condition in make_dir\n  * [extractor/anchorfm] Add episode\n  * [extractor/boxcast] Add extractor\n  * [extractor/ebay] Add extractor\n  * [extractor/hypergryph] Add extractor\n  * [extractor/NZOnScreen] Add extractor\n  * [extractor/rozhlas] Add extractor\n  * [extractor/tempo] Add IVXPlayer extractor\n  * [extractor/txxx] Add extractors\n  * [extractor/vocaroo] Add extractor\n  * [extractor/wrestleuniverse] Add extractors\n  * [extractor/yappy] Add extractor\n  * [extractor/youtube] Fix uploader_id extraction\n  * [extractor/youtube] Add hyperpipe instances\n  * [extractor/youtube] Handle consent.youtube\n  * [extractor/youtube] Support /live/ URL\n  * [extractor/youtube] Update invidious and piped instances\n  * [extractor/91porn] Fix title and comment extraction\n  * [extractor/AbemaTV] Cache user token whenever appropriate\n  * [extractor/bfmtv] Support rmc prefix\n  * [extractor/biliintl] Add intro and ending chapters\n  * [extractor/clyp] Support wav\n  * [extractor/crunchyroll] Add intro chapter\n  * [extractor/crunchyroll] Better message for premium videos\n  * [extractor/crunchyroll] Fix incorrect premium-only error\n  * [extractor/DouyuTV] Use new API\n  * [extractor/embedly] Embedded links may be for other extractors\n  * [extractor/freesound] Workaround invalid URL in webpage\n  * [extractor/GoPlay] Use new API\n  * [extractor/Hidive] Fix subtitles and age-restriction\n  * [extractor/huya] Support HD streams\n  * [extractor/moviepilot] Fix extractor\n  * [extractor/nbc] Fix NBC and NBCStations extractors\n  * [extractor/nbc] Fix XML parsing\n  * [extractor/nebula] Remove broken cookie support\n  * [extractor/nfl] Add NFLPlus extractor\n  * [extractor/niconico] Add support for like history\n  * [extractor/nitter] Update instance list by OIRNOIR\n  * [extractor/npo] Fix extractor and add HD support\n  * [extractor/odkmedia] Add OnDemandChinaEpisodeIE\n  * [extractor/pornez] Handle relative URLs in iframe\n  * [extractor/radiko] Fix format sorting for Time Free\n  * [extractor/rcs] Fix extractors\n  * [extractor/reddit] Support user posts\n  * [extractor/rumble] Fix format sorting\n  * [extractor/servus] Rewrite extractor\n  * [extractor/slideslive] Fix slides and chapters/duration\n  * [extractor/SportDeutschland] Fix extractor\n  * [extractor/Stripchat] Fix extractor\n  * [extractor/tnaflix] Fix extractor\n  * [extractor/tvp] Support stream.tvp.pl\n  * [extractor/twitter] Fix --no-playlist and add media\n    view_count when using GraphQL\n  * [extractor/twitter] Fix graphql extraction on some tweets\n  * [extractor/vimeo] Fix playerConfig extraction\n  * [extractor/viu] Add ViuOTTIndonesiaIE extractor\n  * [extractor/vk] Fix playlists for new API\n  * [extractor/vlive] Replace with VLiveWebArchiveIE\n  * [extractor/ximalaya] Update album _VALID_URL\n  * [extractor/zdf] Use android API endpoint for UHD downloads\n  * [youtube] Improve description extraction\n  * [youtube] Prevent excess HTTP 301\n  * [bellmedia] Add support for cp24.com clip URLs","modified":"2026-03-11T07:33:31.685393Z","published":"2023-11-18T19:00:58Z","related":["CVE-2023-35934","CVE-2023-46121"],"upstream":["CVE-2023-35934","CVE-2023-46121"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6MA5EHVFVH4HRBQQ5KZZ4YVOXJFQUG3W/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1213124"},{"type":"REPORT","url":"https://bugzilla.suse.com/1216467"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-35934"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-46121"}],"affected":[{"package":{"name":"yt-dlp","ecosystem":"SUSE:Package Hub 15 SP5","purl":"pkg:rpm/suse/yt-dlp&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.11.14-bp155.3.3.1"}]}],"ecosystem_specific":{"binaries":[{"yt-dlp":"2023.11.14-bp155.3.3.1","python311-yt-dlp":"2023.11.14-bp155.3.3.1","yt-dlp-bash-completion":"2023.11.14-bp155.3.3.1","yt-dlp-fish-completion":"2023.11.14-bp155.3.3.1","yt-dlp-zsh-completion":"2023.11.14-bp155.3.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0374-1.json"}},{"package":{"name":"yt-dlp","ecosystem":"openSUSE:Leap 15.5","purl":"pkg:rpm/opensuse/yt-dlp&distro=openSUSE%20Leap%2015.5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.11.14-bp155.3.3.1"}]}],"ecosystem_specific":{"binaries":[{"python311-yt-dlp":"2023.11.14-bp155.3.3.1","yt-dlp-bash-completion":"2023.11.14-bp155.3.3.1","yt-dlp-fish-completion":"2023.11.14-bp155.3.3.1","yt-dlp-zsh-completion":"2023.11.14-bp155.3.3.1","yt-dlp":"2023.11.14-bp155.3.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0374-1.json"}}],"schema_version":"1.7.5"}