{"action":"Upgrade bottle to 0.12.19 or later.","affected":[{"fixed":"0.12.19","introduced":"0"}],"component":"bottle","cve_ids":["CVE-2020-28473"],"ecosystem":"PyPI","epss":0.01786,"exploited":false,"fixed_versions":["0.12.19"],"ghsa_id":"GHSA-qhx9-7hx7-cp4r","id":"tcs_01M5KFW7DXDHYGR7WFRGFMVEA9","modified_at":"2024-09-13T14:45:31.941471Z","published_at":"2021-04-07T21:05:21Z","references":["https://osv.dev/vulnerability/GHSA-qhx9-7hx7-cp4r","https://nvd.nist.gov/vuln/detail/CVE-2020-28473","https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b","https://github.com/advisories/GHSA-qhx9-7hx7-cp4r","https://github.com/bottlepy/bottle","https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2021-129.yaml","https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages","https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-qhx9-7hx7-cp4r","url":"https://osv.dev/vulnerability/GHSA-qhx9-7hx7-cp4r"}],"summary":"bottle HTTP Request smuggling"}