PT-2020-5561 · Bottle+5 · Bottle+5

Published 2020-10-13 · Updated 2021-10-06 · CVE-2020-28473

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:M/Au:N/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions bottle versions 0 through 0.12.19

Description The issue is related to Web Cache Poisoning by using a vector called parameter cloaking. When an attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Recommendations For versions 0 through 0.12.19, update to version 0.12.19 or later to resolve the issue. As a temporary workaround, consider restricting the use of semicolons in query parameters to minimize the risk of exploitation.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2021-1117

BDU:2021-01160

CVE-2020-28473

DLA-2531-1

GHSA-QHX9-7HX7-CP4R

MGASA-2021-0171

OESA-2021-1067

OPENSUSE-SU-2021:0302-1

OPENSUSE-SU-2021_0302-1

OPENSUSE-SU-2024:13210-1

PYSEC-2021-129

SNYK-PYTHON-BOTTLE-1017108

SUSE-SU-2021:0483-1

SUSE-SU-2021_0483-1

USN-5105-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

Bottle

References · 37

• 🔥 https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108 · Exploit
• https://osv.dev/vulnerability/DLA-2531-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5105-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28473 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28473 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhx9-7hx7-cp4r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28473 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:0483-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28473 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28473 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28473 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0171.html · Security Note
• https://osv.dev/vulnerability/USN-5105-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-129 · Vendor Advisory