CVE-2020-28473
2 advisories.
PyPI/bottle CVE-2020-28473: medium 6.8, EPSS 1.79%
bottle HTTP Request smuggling
Action: Upgrade bottle to 0.12.19 or later.
pip install bottle==0.12.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.19 | - |
Fixed versions
| 0.12.19 |
Sources
- osv: GHSA-qhx9-7hx7-cp4r
- https://nvd.nist.gov/vuln/detail/CVE-2020-28473
- https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b
- https://github.com/advisories/GHSA-qhx9-7hx7-cp4r
- https://github.com/bottlepy/bottle
- https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2021-129.yaml
- https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html
- https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages
- https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108
CVE-2020-28473 · published · modified · JSON
PyPI/bottle CVE-2020-28473: unknown, EPSS 1.79%
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), t
Action: Upgrade bottle to 0.12.19 or later.
pip install bottle==0.12.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.19 | - |
Fixed versions
| 0.12.19 |
Sources
- osv: PYSEC-2021-129
- https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108
- https://github.com/bottlepy/bottle
- https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
- https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html
- https://github.com/advisories/GHSA-qhx9-7hx7-cp4r
CVE-2020-28473 · published · modified · JSON