CVE-2016-9964 bottle.py vulnerable to CRLF Injection
MediumCVSS 6.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi bottle(PyPI) | >= 0.10.1, < 0.12.11 | 0.12.11 |
| pypi bottle(PyPI) | = 0.10.1 | No fix listed |
| pypi bottle(PyPI) | = 0.10.10 | No fix listed |
| pypi bottle(PyPI) | = 0.10.11 | No fix listed |
| pypi bottle(PyPI) | = 0.10.12 | No fix listed |
| pypi bottle(PyPI) | = 0.10.2 | No fix listed |
| pypi bottle(PyPI) | = 0.10.3 | No fix listed |
| pypi bottle(PyPI) | = 0.10.4 | No fix listed |
| pypi bottle(PyPI) | = 0.10.5 | No fix listed |
| pypi bottle(PyPI) | = 0.10.6 | No fix listed |
| pypi bottle(PyPI) | = 0.10.7 | No fix listed |
| pypi bottle(PyPI) | = 0.10.8 | No fix listed |
| pypi bottle(PyPI) | = 0.10.9 | No fix listed |
| pypi bottle(PyPI) | = 0.11.1 | No fix listed |
| pypi bottle(PyPI) | = 0.11.2 | No fix listed |
| pypi bottle(PyPI) | = 0.11.3 | No fix listed |
| pypi bottle(PyPI) | = 0.11.4 | No fix listed |
| pypi bottle(PyPI) | = 0.11.5 | No fix listed |
| pypi bottle(PyPI) | = 0.11.6 | No fix listed |
| pypi bottle(PyPI) | = 0.11.7 | No fix listed |
| pypi bottle(PyPI) | = 0.12.1 | No fix listed |
| pypi bottle(PyPI) | = 0.12.10 | No fix listed |
| pypi bottle(PyPI) | = 0.12.2 | No fix listed |
| pypi bottle(PyPI) | = 0.12.3 | No fix listed |
| pypi bottle(PyPI) | = 0.12.4 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi bottle(PyPI) | = 0.12.5 | No fix listed |
| pypi bottle(PyPI) | = 0.12.6 | No fix listed |
| pypi bottle(PyPI) | = 0.12.7 | No fix listed |
| pypi bottle(PyPI) | = 0.12.8 | No fix listed |
| pypi bottle(PyPI) | = 0.12.9 | No fix listed |
| debian/python-bottle(Debian:12) | < 0.12.11-1 | 0.12.11-1 |
| debian/python-bottle(Debian:13) | < 0.12.11-1 | 0.12.11-1 |
| debian/python-bottle(Debian:14) | < 0.12.11-1 | 0.12.11-1 |
| bottlepy bottle | = 0.12.10 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com vendor-advisory
- github.com product
- github.com
- web.archive.org
- DSA-3743 third-party-advisory vendor-advisory
- 94961 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2016-9964 vendor-advisory
- bugs.debian.org issue-tracking