{"action":"Upgrade bottle to 0.12.11 or later.","affected":[{"fixed":"0.12.11","introduced":"0.10.1"}],"component":"bottle","cve_ids":["CVE-2016-9964"],"ecosystem":"PyPI","epss":0.01761,"exploited":false,"fixed_versions":["0.12.11"],"ghsa_id":"GHSA-j6f7-hghw-g437","id":"tcs_01M5KG6VK25CWV5889Q4J9EZMA","modified_at":"2023-11-08T03:58:39.635834Z","published_at":"2016-12-16T09:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2016-24","https://github.com/bottlepy/bottle/issues/913","https://github.com/bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54","http://www.securityfocus.com/bid/94961","http://www.debian.org/security/2016/dsa-3743","https://github.com/advisories/GHSA-j6f7-hghw-g437"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2016-24","url":"https://osv.dev/vulnerability/PYSEC-2016-24"}],"summary":"redirect() in bottle.py in bottle 0.12.10 doesn't filter a \"\\r\\n\" sequence, which leads to a CRLF attack, as demonstrated by a redirect(\"233\\r\\nSet-Cookie: name=salt\") call."}