CriticalCVSS 9.3
Bottle before 0.12.20 mishandles errors during early request binding.
Product
debian/python-bottle vulnerabilities
4 published CVES affecting debian/python-bottle, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 1
- High
- 0
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest debian/python-bottle CVEs
Newest publication first
-
-
MediumCVSS 6.5
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
-
MediumCVSS 6.8
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be...
-
MediumCVSS 6.1
The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.