PT-2016-7891 · Bottle · Bottle

Altop · Publicado 2016-12-16 · Atualizado 2022-05-17 · CVE-2016-9964

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bottle versions 0.12.10

Description The issue concerns a CRLF attack due to the redirect() function in bottle.py not filtering a "r " sequence. This is demonstrated by a redirect("233r Set-Cookie: name=salt") call, which can lead to security issues.

Recommendations For version 0.12.10, consider disabling the redirect() function until a patch is available to prevent potential CRLF attacks. Restrict access to the redirect() function to minimize the risk of exploitation. Avoid using the redirect() function with unfiltered user input until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

CVE-2016-9964

DLA-761-1

DSA-3743-1

DSA-3743-2

GHSA-J6F7-HGHW-G437

MGASA-2017-0031

OPENSUSE-SU-2024:11220-1

PYSEC-2016-24

Produtos afetados

Bottle

Referências · 24

• https://github.com/bottlepy/bottle · Nota
• https://github.com/bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54 · Correção
• https://github.com/bottlepy/bottle/issues/913 · Correção
• https://github.com/bottlepy/bottle/commit/78f67d51965db11cb1ed0003f1eb7926458b5c2c · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2016-24.yaml · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9964 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3743-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j6f7-hghw-g437 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9964 · Nota de Segurança
• http://securityfocus.com/bid/94961 · Nota
• http://debian.org/security/2016/dsa-3743 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0031.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=20004 · Nota
• https://ubuntu.com/security/CVE-2016-9964 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-9964 · Aviso do Fabricante