| Package | Affected versions | Patched versions |
|---|---|---|
| bottle | ≥ 0.10.0, < 0.10.12≥ 0.11, < 0.11.7≥ 0.11.0, < 0.11.7≥ 0.12, < 0.12.6≥ 0.12.0, < 0.12.6≥ 0.8, < 0.10.12 | 0.10.120.11.70.12.6 |
| bottle | = 0.10.0= 0.10.1= 0.10.10= 0.10.11= 0.10.2= 0.10.3= 0.10.4= 0.10.5= 0.10.6= 0.10.7= 0.10.8= 0.10.9= 0.11.0= 0.11.1= 0.11.2= 0.11.3= 0.11.4= 0.11.5= 0.11.6= 0.11.7= 0.12.0= 0.12.1= 0.12.2= 0.12.3= 0.12.4= 0.12.5 |
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free