PyPI/bottle CVE-2016-9964: medium 6.5, EPSS 1.76%

bottle.py vulnerable to CRLF Injection

Action: Upgrade bottle to 0.12.11 or later.

pip install bottle==0.12.11

Affected

Fixed versions

Sources

• osv: GHSA-j6f7-hghw-g437
• https://nvd.nist.gov/vuln/detail/CVE-2016-9964
• https://github.com/bottlepy/bottle/issues/913
• https://github.com/bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54
• https://github.com/bottlepy/bottle/commit/78f67d51965db11cb1ed0003f1eb7926458b5c2c
• https://github.com/advisories/GHSA-j6f7-hghw-g437
• https://github.com/bottlepy/bottle
• https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2016-24.yaml
• https://web.archive.org/web/20170214030628/http://www.securityfocus.com/bid/94961
• http://www.debian.org/security/2016/dsa-3743

CVE-2016-9964 · published 2022-05-17T03:05:15Z · modified 2024-11-25T05:23:41.636493Z · JSON