GitHub Advisoryadvisory · PyPI

GHSA-j6f7-hghw-g437 bottle.py vulnerable to CRLF Injection

HIGH Published 2022-05-17 Modified 2024-11-18 Official page ↗
Aliases
CVE-2016-9964
Ecosystem
PyPI
Packages
bottle
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-93
Reviewed
2022-05-31

Affected packages

• PyPI bottle: >= 0.10.1, < 0.12.11 → fixed in 0.12.11

Description

bottle.py is a fast and simple micro-framework for python web-applications. redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

Related

Alias · CVE (1)

  • CVE-2016-9964 redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a… vulnerability

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References