Web Cache Poisoning Vulnerability in Python Bottle Package
Summary
UBUNTU-CVE-2020-28473: The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. Affects python-bottle versions < 0.12.0-1ubuntu0.1~esm2. Fixed in 0.12.0-1ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Bottle package is a lightweight WSGI micro web framework for Python, designed for building small web applications. It is known for its simplicity and ease of use, making it a popular choice for developers. However, versions prior to 0.12.19 are susceptible to a serious vulnerability that can lead to web cache poisoning, compromising the integrity of cached content.
Vulnerability Detail
The vulnerability arises from a flaw in how the Bottle package handles query parameters, specifically when an attacker can use a semicolon (;) to separate parameters. This can lead to a discrepancy in how requests are interpreted by the proxy server and the application server. As a result, malicious requests may be cached as safe ones, allowing attackers to exploit this behavior to serve harmful content to users. The vulnerability is classified under CVE-2020-28473 and has a CVSS score of 6.8, indicating a medium severity level.
How To Fix
Minimum fixed version
0.12.0-1ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bottleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using semicolons in query parameters until the package is updated. Additionally, configuring the proxy server to handle parameters more securely may mitigate some risks.
Conclusion
The Python Bottle package has a significant vulnerability that can lead to web cache poisoning. It is crucial for users to update to the latest version to protect their applications from potential exploitation. By following the provided steps to update the package and considering the workaround, developers can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for python-bottle →
FAQ
The vulnerability can lead to web cache poisoning, allowing attackers to serve malicious content to users by exploiting how query parameters are processed.
All versions of Python Bottle prior to 0.12.19 are vulnerable to this issue.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 6.8, indicating a medium severity level.
No, the patched version of the Python Bottle package is available without any subscription requirements.
Related vulnerabilities
Recent vulnerabilities recorded for python-bottle.
