CRLF Injection Vulnerability in Python Bottle Package - CVE-2016-9964
Summary
UBUNTU-CVE-2016-9964: redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call. Affects python-bottle versions < 0.12.0-1ubuntu0.1~esm1. Fixed in 0.12.0-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Bottle package is a lightweight WSGI micro web framework for Python, designed for building small web applications quickly and efficiently. It is known for its simplicity and ease of use, making it a popular choice among developers. However, the package has been found to be vulnerable to a CRLF injection attack, which can compromise the security of applications built using this framework.
Vulnerability Detail
The vulnerability identified as CVE-2016-9964 arises from the redirect() function in bottle.py, specifically in version 0.12.10. This function fails to properly filter a '\r\n' sequence, allowing attackers to perform a CRLF (Carriage Return Line Feed) injection. This can lead to various security issues, including HTTP response splitting, which may enable attackers to set cookies or manipulate headers, potentially compromising user sessions and data integrity.
How To Fix
Minimum fixed version
0.12.0-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bottleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to sanitize user inputs that are passed to the redirect() function, ensuring that no CRLF sequences are included. This can be done by replacing or removing any instances of '\r' and '\n' from the input before processing it.
Conclusion
The CVE-2016-9964 vulnerability in the Python Bottle package poses a significant risk due to its potential for CRLF injection attacks. It is crucial for developers to update their packages to the latest patched versions and implement necessary input validation to safeguard their applications.
See every vulnerability recorded for python-bottle →
FAQ
CVE-2016-9964 is a vulnerability in the Python Bottle package that allows for CRLF injection attacks due to improper filtering in the redirect() function.
Exploiting this vulnerability can lead to HTTP response splitting, allowing attackers to manipulate headers and potentially hijack user sessions.
Yes, patched versions of the Python Bottle package are available. Users should update to version 0.12.0-1ubuntu0.1~esm1 or 0.12.7-1+deb8u1build0.16.04.1 depending on their Ubuntu version.
If an immediate update is not possible, implement input validation to sanitize any user inputs that may be passed to the redirect() function.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-bottle.
