The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector     called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can     cause a difference in the interpretation of the request between the proxy (running with default     configuration) and the server. This can result in malicious requests being cached as completely safe ones,     as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a     cache key of an unkeyed parameter. (CVE-2020-28473)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5105-1 advisory.

    It was discovered that Bottle incorrectly handled certain inputs. An attacker could possibly use this     issue to cache malicious requests.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-bottle fixes the following issues :

  - CVE-2020-28473: Fixed Web Cache Poisoning vulnerability     using parameter cloaking (bsc#1182181).

This update was imported from the SUSE:SLE-15:Update update project.

The package src:python-bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking.

When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server.
This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

For Debian 9 stretch, this problem has been fixed in version 0.12.13-1+deb9u1.

We recommend that you upgrade your python-bottle packages.

For the detailed security status of python-bottle please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/python-bottle

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257562	Linux Distros Unpatched Vulnerability : CVE-2020-28473	Nessus	Misc.	medium
153910	Ubuntu 18.04 LTS / 20.04 LTS : Bottle vulnerability (USN-5105-1)	Nessus	Ubuntu Local Security Checks	medium
146662	openSUSE Security Update : python-bottle (openSUSE-2021-302)	Nessus	SuSE Local Security Checks	medium
145384	Debian DLA-2531-1 : python-bottle security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-28473

medium

Tenable Plugins

medium

medium

medium

medium