CVE-2016-9964: CRLF Injection
Published Dec 16, 2016
·Updated
bottle.py is a fast and simple micro-framework for python web-applications. redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
Affected Software
3 affected componentsFixes available
pip/bottle>=0.10.1<0.12.11
0.12.11
Bottlepy Bottle=0.12.10
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Dec 16, 2016
CVE Published
via MITRE·09:02 AM
Data Sourced
via MITRE·09:02 AM
Description
May 17, 2022
Advisory Published
via GitHub·03:05 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-9964?
CVE-2016-9964 has a medium severity level due to its potential for CRLF attacks.
2
How do I fix CVE-2016-9964?
To fix CVE-2016-9964, upgrade to bottle version 0.12.11 or later.
3
What is the impact of CVE-2016-9964 on applications using bottle.py?
CVE-2016-9964 allows an attacker to perform CRLF injection, which could lead to session hijacking or request forgery.
4
Which versions of bottle.py are affected by CVE-2016-9964?
CVE-2016-9964 affects bottle.py version 0.12.10.
5
Can CVE-2016-9964 affect web applications deployed on Debian 8.0?
Yes, web applications deployed on Debian 8.0 using bottle.py version 0.12.10 are susceptible to CVE-2016-9964.