{"schemaVersion":3,"id":"OPENSUSE-SU-2023:0374-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for yt-dlp\n\nThis update for yt-dlp fixes the following issues:\n\n- Update to release 2023.11.14\n\n  * Security: [CVE-2023-46121] Patch Generic Extractor MITM\n    Vulnerability via Arbitrary Proxy Injection\n  * Disallow smuggling of arbitrary http_headers; extractors now\n    only use specific headers\n\n- Make yt-dlp require the one pythonXX-yt-dlp that /usr/bin/yt-dlp\n  was built with.\n\n- Rework Python build procedure [boo#1216467]\n- Enable Python library [boo#1216467]\n\n- Update to release 2023.10.13\n\n  * youtube: fix some bug with --extractor-retries inf\n\n- Update to release 2023.10.07\n\n  * yt: Fix heatmap extraction\n  * yt: Raise a warning for Incomplete Data instead of an error\n\n- Update to release 2023.09.24\n\n  * Extract subtitles from SMIL manifests\n  * fb: Add dash manifest URL\n  * crunchyroll: Remove initial state extraction\n  * youtube: Add player_params extractor arg\n\n- remove suggests on brotlicffi - this is only for != cpython\n\n- Update to release 2023.07.06\n\n  * Prevent Cookie leaks on HTTP redirect [boo#1213124] [CVE-2023-35934]\n  * yt: Avoid false DRM detection\n  * yt: Process post_live over 2 hours\n  * yt: Support shorts-only playlists\n\n- Update to release 2023.06.22\n\n   * youtube: add IOS to default clients used\n\n- Update to release 2023.06.21\n\n  * Add option --compat-option playlist-match-filter\n  * Add options --no-quiet, option --color, --netrc-cmd, --xff\n  * Auto-select default format in -f-\n  * Improve HTTP redirect handling\n  * Support decoding multiple content encodings\n\n- Use python3.11 on Leap 15.5\n\n  * python3.11 is the only python3 > 3.6 version would be shipped\n    in Leap 15.5\n\n- Update to release 2023.03.04\n\n  * A bunch of extractor fixes\n\n- Update to release 2023.03.03\n\n  * youtube: Construct dash formats with range query\n  * yt: Detect and break on looping comments\n  * yt: Extract channel view_count when /about tab is passed\n\n- Update to release 2023.02.17\n\n  * Merge youtube-dl: Upto commit/2dd6c6e (Feb 17 2023)\n  * Fix --concat-playlist\n  * Imply --no-progress when --print\n  * Improve default subtitle language selection\n  * Make title completely non-fatal\n  * Sanitize formats before sorting\n  * [hls] Allow extractors to provide AES key\n  * [extractor/generic] Avoid catastrophic backtracking in KVS regex\n  * [jsinterp] Support if statements\n  * [plugins] Fix zip search paths\n  * [utils] Don't use Content-length with encoding\n  * [utils] Fix time_seconds to use the provided TZ\n  * [utils] Fix race condition in make_dir\n  * [extractor/anchorfm] Add episode\n  * [extractor/boxcast] Add extractor\n  * [extractor/ebay] Add extractor\n  * [extractor/hypergryph] Add extractor\n  * [extractor/NZOnScreen] Add extractor\n  * [extractor/rozhlas] Add extractor\n  * [extractor/tempo] Add IVXPlayer extractor\n  * [extractor/txxx] Add extractors\n  * [extractor/vocaroo] Add extractor\n  * [extractor/wrestleuniverse] Add extractors\n  * [extractor/yappy] Add extractor\n  * [extractor/youtube] Fix uploader_id extraction\n  * [extractor/youtube] Add hyperpipe instances\n  * [extractor/youtube] Handle consent.youtube\n  * [extractor/youtube] Support /live/ URL\n  * [extractor/youtube] Update invidious and piped instances\n  * [extractor/91porn] Fix title and comment extraction\n  * [extractor/AbemaTV] Cache user token whenever appropriate\n  * [extractor/bfmtv] Support rmc prefix\n  * [extractor/biliintl] Add intro and ending chapters\n  * [extractor/clyp] Support wav\n  * [extractor/crunchyroll] Add intro chapter\n  * [extractor/crunchyroll] Better message for premium videos\n  * [extractor/crunchyroll] Fix incorrect premium-only error\n  * [extractor/DouyuTV] Use new API\n  * [extractor/embedly] Embedded links may be for other extractors\n  * [extractor/freesound] Workaround invalid URL in webpage\n  * [extractor/GoPlay] Use new API\n  * [extractor/Hidive] Fix subtitles and age-restriction\n  * [extractor/huya] Support HD streams\n  * [extractor/moviepilot] Fix extractor\n  * [extractor/nbc] Fix NBC and NBCStations extractors\n  * [extractor/nbc] Fix XML parsing\n  * [extractor/nebula] Remove broken cookie support\n  * [extractor/nfl] Add NFLPlus extractor\n  * [extractor/niconico] Add support for like history\n  * [extractor/nitter] Update instance list by OIRNOIR\n  * [extractor/npo] Fix extractor and add HD support\n  * [extractor/odkmedia] Add OnDemandChinaEpisodeIE\n  * [extractor/pornez] Handle relative URLs in iframe\n  * [extractor/radiko] Fix format sorting for Time Free\n  * [extractor/rcs] Fix extractors\n  * [extractor/reddit] Support user posts\n  * [extractor/rumble] Fix format sorting\n  * [extractor/servus] Rewrite extractor\n  * [extractor/slideslive] Fix slides and chapters/duration\n  * [extractor/SportDeutschland] Fix extractor\n  * [extractor/Stripchat] Fix extractor\n  * [extractor/tnaflix] Fix extractor\n  * [extractor/tvp] Support stream.tvp.pl\n  * [extractor/twitter] Fix --no-playlist and add media\n    view_count when using GraphQL\n  * [extractor/twitter] Fix graphql extraction on some tweets\n  * [extractor/vimeo] Fix playerConfig extraction\n  * [extractor/viu] Add ViuOTTIndonesiaIE extractor\n  * [extractor/vk] Fix playlists for new API\n  * [extractor/vlive] Replace with VLiveWebArchiveIE\n  * [extractor/ximalaya] Update album _VALID_URL\n  * [extractor/zdf] Use android API endpoint for UHD downloads\n  * [youtube] Improve description extraction\n  * [youtube] Prevent excess HTTP 301\n  * [bellmedia] Add support for cp24.com clip URLs","dates":{"published":"2023-11-18T19:00:58.000Z","modified":"2026-02-04T04:28:34.957Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"yt-dlp&distro=openSUSE Leap 15.5","name":"yt-dlp","label":"yt-dlp&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/yt-dlp&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 2023.11.14-bp155.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2023.11.14-bp155.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"yt-dlp&distro=SUSE Package Hub 15 SP5","name":"yt-dlp","label":"yt-dlp&distro=SUSE Package Hub 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/yt-dlp&distro=SUSE Package Hub 15 SP5","purlType":"rpm","versions":[{"text":"< 2023.11.14-bp155.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2023.11.14-bp155.3.3.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6MA5EHVFVH4HRBQQ5KZZ4YVOXJFQUG3W/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1213124","label":"bugzilla.suse.com/1213124","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1216467","label":"bugzilla.suse.com/1216467","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-35934","label":"www.suse.com/security/cve/CVE-2023-35934","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46121","label":"www.suse.com/security/cve/CVE-2023-46121","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2023-35934","CVE-2023-46121"],"downstream":[],"duplicates":[],"related":["CVE-2023-35934","CVE-2023-46121"]},"timeline":[{"kind":"published","date":"2023-11-18T19:00:58.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T04:28:34.957Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T23:58:49.276Z","stale":false,"partial":false}}