CVE-2022-31799 : Bottle before 0.12.20 mishandles errors during early request binding.

Bottle before 0.12.20 mishandles errors during early request binding.

Published 2022-06-02 14:15:58

Updated 2022-12-12 20:20:46

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-31799

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Matching versions
Bottlepy » Bottle
Versions before (<) 0.12.20
cpe:2.3:a:bottlepy:bottle:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 72 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-755 Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

Assigned by: nvd@nist.gov (Primary)

https://lists.debian.org/debian-lts-announce/2022/06/msg00010.html

[SECURITY] [DLA 3048-1] python-bottle security update
Mailing List;Third Party Advisory
https://www.debian.org/security/2022/dsa-5159

Debian -- Security Information -- DSA-5159-1 python-bottle
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTLOQGMDZEPIYTFC2G53OQV2ULCGYS3F/

[SECURITY] Fedora 36 Update: python-bottle-0.12.21-2.fc36 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/bottlepy/bottle/compare/0.12.19...0.12.20

Comparing 0.12.19...0.12.20 · bottlepy/bottle · GitHub
Third Party Advisory
https://github.com/bottlepy/bottle/commit/a2b0ee6bb4ce88895429ec4aca856616244c4c4c

Release of 0.12.20 · bottlepy/bottle@a2b0ee6 · GitHub
Patch;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD/

[SECURITY] Fedora 35 Update: python-bottle-0.12.21-2.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/bottlepy/bottle/commit/e140e1b54da721a660f2eb9d58a106b7b3ff2f00

Gracefully handle errors during early request binding. · bottlepy/bottle@e140e1b · GitHub
Patch;Third Party Advisory

Jump to