Описание
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| python-bottle | fixed | 0.12.11-1 | package |
Примечания
Upstream bug: https://github.com/bottlepy/bottle/issues/913
Upstream patch: https://github.com/bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54
EPSS
Процентиль: 78%
0.01087
Низкий
Связанные уязвимости
CVSS3: 6.5
ubuntu
около 9 лет назад
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
CVSS3: 6.5
nvd
около 9 лет назад
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
EPSS
Процентиль: 78%
0.01087
Низкий