PyPI/bottle CVE-2020-28473: medium 6.8, EPSS 1.79%

bottle HTTP Request smuggling

Action: Upgrade bottle to 0.12.19 or later.

pip install bottle==0.12.19

Affected

Fixed versions

Sources

• osv: GHSA-qhx9-7hx7-cp4r
• https://nvd.nist.gov/vuln/detail/CVE-2020-28473
• https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b
• https://github.com/advisories/GHSA-qhx9-7hx7-cp4r
• https://github.com/bottlepy/bottle
• https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2021-129.yaml
• https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html
• https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages
• https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108

CVE-2020-28473 · published 2021-04-07T21:05:21Z · modified 2024-09-13T14:45:31.941471Z · JSON