CVE-2014-3137: Input Validation

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

— GitHub

It was reported that the JSON content-type was not restrictive enough. Bottle treated "text/plain;application/json" as JSON, allowing attackers to bypass intended security mechanisms. From the upstream report, "For example Chrome will not allow cross-origin xmlhttprequests with the content type set to "application/json" but you can set it to "text/plain;application/json" instead and bottle will accept it.".

Upstream report: https://github.com/defnull/bottle/issues/616

Patches for master, 0.11, and 0.12, respectively:

https://github.com/defnull/bottle/commit/7c3226867d9005903e268fedd819389ab8c6336d https://github.com/defnull/bottle/commit/a3c7b6eba63f41968c78ea61a2dd1bf334cff4b0 https://github.com/defnull/bottle/commit/2589f5a808da9d0c2d153c379557e1a090acdf04

— Red Hat