CVE-2016-9964

Description

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

How to fix CVE-2016-9964

To remediate CVE-2016-9964, upgrade the affected package to a fixed version below.

• Debian/python-bottle—upgrade to 0.12.11-1 or later
• —upgrade to 0.10.11-1+deb7u2 or later
• —upgrade to 0.12.7-1+deb8u1 or later
• —upgrade to 0.12.11 or later
• —upgrade to 6d7e13da0f998820800ecb3fe9ccee4189aefb54 or later

Is CVE-2016-9964 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 0.12.11-1
• from 0, < 0.10.11-1+deb7u2
• from 0, < 0.12.7-1+deb8u1
• >= 0.10.1, < 0.12.11
• from 0, < 6d7e13da0f998820800ecb3fe9ccee4189aefb54 | >= 0.10.1, < 0.12.11

CVSS scores

References (11)

• ADVISORYgithub.com/advisories/GHSA-j6f7-hghw-g437
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-9964
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2016-9964
• PATCHgithub.com/bottlepy/bottle
• WEB