PyPI/bottle CVE-2020-28473: unknown, EPSS 1.79%

The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), t

Action: Upgrade bottle to 0.12.19 or later.

pip install bottle==0.12.19

Affected

Fixed versions

Sources

• osv: PYSEC-2021-129
• https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108
• https://github.com/bottlepy/bottle
• https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
• https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html
• https://github.com/advisories/GHSA-qhx9-7hx7-cp4r

CVE-2020-28473 · published 2021-01-18T12:15:00Z · modified 2023-11-08T04:03:27.869657Z · JSON