pysec - pysec-2021-129

PYSEC-2021-129

Vulnerability from pysec - Published: 2021-01-18 12:15 - Updated: 2021-08-27 03:21

Details

The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Impacted products

Name	purl
bottle	pkg:pypi/bottle

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "bottle",
        "purl": "pkg:pypi/bottle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.1",
        "0.10.10",
        "0.10.11",
        "0.10.12",
        "0.10.2",
        "0.10.3",
        "0.10.4",
        "0.10.5",
        "0.10.6",
        "0.10.7",
        "0.10.8",
        "0.10.9",
        "0.11.1",
        "0.11.2",
        "0.11.3",
        "0.11.4",
        "0.11.5",
        "0.11.6",
        "0.11.7",
        "0.12.1",
        "0.12.10",
        "0.12.11",
        "0.12.12",
        "0.12.13",
        "0.12.14",
        "0.12.15",
        "0.12.16",
        "0.12.17",
        "0.12.18",
        "0.12.2",
        "0.12.3",
        "0.12.4",
        "0.12.5",
        "0.12.6",
        "0.12.7",
        "0.12.8",
        "0.12.9",
        "0.4.10",
        "0.4.11",
        "0.4.12",
        "0.4.13",
        "0.4.14",
        "0.4.3",
        "0.4.4",
        "0.4.6",
        "0.4.7",
        "0.4.8",
        "0.4.9",
        "0.5.3",
        "0.5.4",
        "0.5.6",
        "0.5.7",
        "0.5.8",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.6.5",
        "0.6.6",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.9.1",
        "0.9.2",
        "0.9.3",
        "0.9.4",
        "0.9.5",
        "0.9.6",
        "0.9.7",
        "0.9.8"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28473",
    "SNYK-PYTHON-BOTTLE-1017108",
    "GHSA-qhx9-7hx7-cp4r"
  ],
  "details": "The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.",
  "id": "PYSEC-2021-129",
  "modified": "2021-08-27T03:21:56.437494Z",
  "published": "2021-01-18T12:15:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bottlepy/bottle"
    },
    {
      "type": "ARTICLE",
      "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-qhx9-7hx7-cp4r"
    }
  ]
}

GHSA-QHX9-7HX7-CP4R

Vulnerability from github – Published: 2021-04-07 21:05 – Updated: 2024-09-13 14:20

Summary

bottle HTTP Request smuggling

Details

The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Severity ?

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

6.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "bottle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28473"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-06T20:59:20Z",
    "nvd_published_at": "2021-01-18T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.",
  "id": "GHSA-qhx9-7hx7-cp4r",
  "modified": "2024-09-13T14:20:37Z",
  "published": "2021-04-07T21:05:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28473"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-qhx9-7hx7-cp4r"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bottlepy/bottle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2021-129.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "bottle HTTP Request smuggling"
}

CVE-2020-28473 (GCVE-0-2020-28473)

Vulnerability from cvelistv5 – Published: 2021-01-18 11:15 – Updated: 2024-09-16 20:41

Summary

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C

CWE

Web Cache Poisoning

Assigner

snyk

References

URL

Tags

	https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108	x_refsource_MISC
	https://github.com/bottlepy/bottle	x_refsource_MISC
	https://snyk.io/blog/cache-poisoning-in-popular-o…	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	bottle	Affected: 0 , < unspecified (custom) Affected: unspecified , < 0.12.19 (custom)

Credits

Snyk Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:40:58.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/bottlepy/bottle"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/"
          },
          {
            "name": "[debian-lts-announce] 20210124 [SECURITY] [DLA 2531-1] python-bottle security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bottle",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.12.19",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Snyk Security Team"
        }
      ],
      "datePublic": "2021-01-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.1,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Web Cache Poisoning",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-24T21:06:09",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bottlepy/bottle"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/"
        },
        {
          "name": "[debian-lts-announce] 20210124 [SECURITY] [DLA 2531-1] python-bottle security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html"
        }
      ],
      "title": "Web Cache Poisoning",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2021-01-18T11:12:14.506344Z",
          "ID": "CVE-2020-28473",
          "STATE": "PUBLIC",
          "TITLE": "Web Cache Poisoning"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "bottle",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.12.19"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Snyk Security Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Web Cache Poisoning"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108"
            },
            {
              "name": "https://github.com/bottlepy/bottle",
              "refsource": "MISC",
              "url": "https://github.com/bottlepy/bottle"
            },
            {
              "name": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/",
              "refsource": "CONFIRM",
              "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/"
            },
            {
              "name": "[debian-lts-announce] 20210124 [SECURITY] [DLA 2531-1] python-bottle security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2020-28473",
    "datePublished": "2021-01-18T11:15:14.918598Z",
    "dateReserved": "2020-11-12T00:00:00",
    "dateUpdated": "2024-09-16T20:41:35.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2021-129

GHSA-QHX9-7HX7-CP4R

CVE-2020-28473 (GCVE-0-2020-28473)

Tags

Sightings

Nomenclature