redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack,
    as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call. (CVE-2016-9964)

Update to 0.12.13

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter '\r\n' sequences when handling redirections. This allowed an attacker to perform CRLF attacks such as HTTP header injection.

ID	Name	Product	Family	Severity
416187	SCA: security update for bottle (GHSA-j6f7-hghw-g437)	Tenable Cloud Security	SCA Checks	high
416187	SCA: security update for bottle (GHSA-j6f7-hghw-g437)	Tenable Self-Hosted Container Security	SCA Checks	high
106282	Fedora 26 : python-bottle (2018-909707fc68)	Nessus	Fedora Local Security Checks	medium
106277	Fedora 27 : python-bottle (2018-6cb474b8ff)	Nessus	Fedora Local Security Checks	medium
95958	Debian DSA-3743-1 : python-bottle - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-9964

high

Tenable Plugins

high

high

medium

medium

medium