Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit
    content types, which allows remote attackers to bypass intended access restrictions via an accepted
    Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated
    in YouCompleteMe to execute arbitrary code. (CVE-2014-3137)

resolves rhbz#1093257 - JSON content type not restrictive enough

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Bottle, a WSGI-framework for Python, performed a too permissive detection of JSON content, resulting a potential bypass of security mechanisms.

ID	Name	Product	Family	Type	Severity
433644	SCA: security update for bottle (GHSA-873q-wpqr-xfgw)	Tenable Cloud Security	SCA Checks	Local	critical
433644	SCA: security update for bottle (GHSA-873q-wpqr-xfgw)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
77205	Fedora 20 : python-bottle-0.12.6-1.fc20 (2014-8334)	Nessus	Fedora Local Security Checks	Local	medium
77203	Fedora 19 : python-bottle-0.12.6-1.fc19 (2014-8328)	Nessus	Fedora Local Security Checks	Local	medium
74315	Debian DSA-2948-1 : python-bottle - security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-3137

critical

Tenable Plugins

critical

critical

medium

medium

medium