CVE:CVE-2023-35934
CNNVD:CNNVD-202307-459
yt-dlp是基于现在不活动的youtube-dlc 的youtube-dl分支。
yt-dlp 2023.07.06 版本之前存在输入验证错误漏洞，该漏洞源于该应用使用的外部下载器可能会在 HTTP 重定向到其他主机时泄漏 cookie。
solution:Upgrade youtube-dlc_project youtube-dlc to a higher version than *; yt-dl youtube-dl avoid the version [2015.01.25,); Upgrade yt-dlp_project yt-dlp to a higher version than 2023.07.06,2023.07.06.185519,and avoid the version (,2023.07.06),(,2023.07.06.185519); Upgrade fedoraproject fedora to a higher version than 37,38,and avoid the version 37,38