PT-2016-7891 · Bottle · Bottle

Altop · Published 2016-12-16 · Updated 2022-05-17 · CVE-2016-9964

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bottle versions 0.12.10

Description The issue concerns a CRLF attack due to the redirect() function in bottle.py not filtering a "r " sequence. This is demonstrated by a redirect("233r Set-Cookie: name=salt") call, which can lead to security issues.

Recommendations For version 0.12.10, consider disabling the redirect() function until a patch is available to prevent potential CRLF attacks. Restrict access to the redirect() function to minimize the risk of exploitation. Avoid using the redirect() function with unfiltered user input until the issue is resolved.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2016-9964

DLA-761-1

DSA-3743-1

DSA-3743-2

GHSA-J6F7-HGHW-G437

MGASA-2017-0031

OPENSUSE-SU-2024:11220-1

PYSEC-2016-24

Affected Products

Bottle

References · 24

• https://github.com/bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54 · Patch
• https://github.com/bottlepy/bottle/issues/913 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9964 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3743-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6f7-hghw-g437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9964 · Security Note
• http://debian.org/security/2016/dsa-3743 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0031.html · Security Note
• https://ubuntu.com/security/CVE-2016-9964 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9964 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2016-24 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9964 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0031 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9964 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3743-2 · Vendor Advisory