Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-J6F7-HGHW-G437
HistoryMay 17, 2022 - 3:05 a.m.

bottle.py vulnerable to CRLF Injection

2022-05-1703:05:15
CWE-93
GitHub Advisory Database
github.com
18
bottle.py
crlf injection
web-applications

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

57.6%

JSON

bottle.py is a fast and simple micro-framework for python web-applications. redirect() in bottle.py in bottle 0.12.10 doesn’t filter a “\r\n” sequence, which leads to a CRLF attack, as demonstrated by a redirect(“233\r\nSet-Cookie: name=salt”) call.

Affected configurations

Vulners
Node
bottle-auth_projectbottle-authRange0.10.1–0.12.11
VendorProductVersionCPE
bottle-auth_projectbottle-auth*cpe:2.3:a:bottle-auth_project:bottle-auth:*:*:*:*:*:*:*:*

Related

nessus 3
fedora 2
openvas 5
intel 1
ubuntucve 1
debiancve 1
osv 2
debian 3
prion 1
cvelist 1
mageia 1
veracode 1
cve 1
nvd 1
nessus
nessus
Fedora 26 : python-bottle (2018-909707fc68)
2018-01-24 00:00:00
Debian DSA-3743-1 : python-bottle - security update
2016-12-21 00:00:00
Fedora 27 : python-bottle (2018-6cb474b8ff)
2018-01-24 00:00:00
fedora
fedora
[SECURITY] Fedora 26 Update: python-bottle-0.12.13-1.fc26
2018-01-23 21:21:17
[SECURITY] Fedora 27 Update: python-bottle-0.12.13-1.fc27
2018-01-23 21:50:51
openvas
openvas
Fedora Update for python-bottle FEDORA-2018-6cb474b8ff
2018-01-24 00:00:00
Mageia: Security Advisory (MGASA-2017-0031)
2022-01-28 00:00:00
Debian Security Advisory DSA 3743-1 (python-bottle - security update)
2016-12-20 00:00:00
intel
intel
Intel® Quartus® Prime Pro
2018-07-10 00:00:00
ubuntucve
ubuntucve
CVE-2016-9964
2016-12-16 00:00:00
debiancve
debiancve
CVE-2016-9964
2016-12-16 09:59:00
osv
osv
bottle.py vulnerable to CRLF Injection
2022-05-17 03:05:15
PYSEC-2016-24
2016-12-16 09:59:00
debian
debian
[SECURITY] [DLA 761-1] python-bottle security update
2016-12-24 18:16:41
[SECURITY] [DSA 3743-1] python-bottle security update
2016-12-20 19:04:38
[SECURITY] [DSA 3743-1] python-bottle security update
2016-12-20 19:04:38
prion
prion
Design/Logic Flaw
2016-12-16 09:59:00
cvelist
cvelist
CVE-2016-9964
2016-12-16 09:02:00
mageia
mageia
Updated python-bottle packages fix security vulnerability
2017-01-30 01:31:20
veracode
veracode
Carriage Return And Line Feed (CRLF)
2016-12-19 03:00:33
cve
cve
CVE-2016-9964
2016-12-16 09:59:00
nvd
nvd
CVE-2016-9964
2016-12-16 09:59:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

57.6%

JSON
Related for GHSA-J6F7-HGHW-G437
nessus3fedora2openvas5intel1ubuntucve1debiancve1osv2debian3prion1cvelist1mageia1veracode1cve1nvd1