CVE-2022-31799
Bottle before 0.12.20 mishandles errors during early request binding.
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Amazon (hoch), Ubuntu (mittel).
Beschreibung
Bottle before 0.12.20 mishandles errors during early request binding.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | bottle | 0.12.20 |
| alpine 3.16 | py3-bottle | 0.12.21-r0 |
| alpine 3.17 | py3-bottle | 0.12.21-r0 |
| alpine 3.18 | py3-bottle | 0.12.21-r0 |
| alpine 3.19 | py3-bottle | 0.12.21-r0 |
| alpine 3.20 | py3-bottle | 0.12.21-r0 |
| alpine 3.21 | py3-bottle | 0.12.21-r0 |
| alpine 3.22 | py3-bottle | 0.12.21-r0 |
| alpine 3.23 | py3-bottle | 0.12.21-r0 |
| alpine 3.24 | py3-bottle | 0.12.21-r0 |
| alpine edge | py3-bottle | 0.12.21-r0 |
| amazon linux 2 | python3-bottle | 0.12.21-2.amzn2 |
Alle 28 Einträge aus 28 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | bottle | 0.12.20 |
| alpine 3.16 | py3-bottle | 0.12.21-r0 |
| alpine 3.17 | py3-bottle | 0.12.21-r0 |
| alpine 3.18 | py3-bottle | 0.12.21-r0 |
| alpine 3.19 | py3-bottle | 0.12.21-r0 |
| alpine 3.20 | py3-bottle | 0.12.21-r0 |
| alpine 3.21 | py3-bottle | 0.12.21-r0 |
| alpine 3.22 | py3-bottle | 0.12.21-r0 |
| alpine 3.23 | py3-bottle | 0.12.21-r0 |
| alpine 3.24 | py3-bottle | 0.12.21-r0 |
| alpine edge | py3-bottle | 0.12.21-r0 |
| amazon linux 2 | python3-bottle | 0.12.21-2.amzn2 |
| amazon linux 2022 | python3-bottle | 0.12.21-2.amzn2022 |
| amazon linux 2023 | python3-bottle | 0.12.21-2.amzn2023.0.1 |
| debian 10 | python-bottle | 0.12.15-2+deb10u2 |
| debian 11 | python-bottle | 0.12.19-1+deb11u1 |
| debian 12 | python-bottle | 0.12.20-1 |
| debian 13 | python-bottle | 0.12.20-1 |
| debian 14 | python-bottle | 0.12.20-1 |
| debian 9 | python-bottle | 0.12.13-1+deb9u2 |
| echo | python-bottle | 0.12.20-1 |
| ubuntu 14.04-ESM | python-bottle | 0.12.0-1ubuntu0.1~esm3 |
| ubuntu 16.04-ESM | python-bottle | 0.12.7-1+deb8u1ubuntu0.1~esm1 |
| ubuntu 18.04 | python-bottle | 0.12.13-1ubuntu0.2 |
| ubuntu 18.04-ESM | python-bottle | 0.12.13-1ubuntu0.2 |
| ubuntu 20.04 | python-bottle | 0.12.15-2.1ubuntu0.2 |
| ubuntu 20.04-ESM | python-bottle | 0.12.15-2.1ubuntu0.2 |
| ubuntu 22.04 | python-bottle | 0.12.19-1+deb11u1build0.22.04.1 |
Referenzen
- https://github.com/advisories/GHSA-xhp9-4947-rq78
- https://github.com/bottlepy/bottle
- https://github.com/bottlepy/bottle/commit/a2b0ee6bb4ce88895429ec4aca856616244c4c4c
- https://github.com/bottlepy/bottle/commit/e140e1b54da721a660f2eb9d58a106b7b3ff2f00
- https://github.com/bottlepy/bottle/compare/0.12.19...0.12.20
- https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2022-227.yaml
- https://lists.debian.org/debian-lts-announce/2022/06/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD
Alle 16 Referenzen
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTLOQGMDZEPIYTFC2G53OQV2ULCGYS3F
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTLOQGMDZEPIYTFC2G53OQV2ULCGYS3F/
- https://nvd.nist.gov/vuln/detail/CVE-2022-31799
- https://ubuntu.com/security/notices/USN-5532-1
- https://ubuntu.com/security/notices/USN-5532-2
- https://www.cve.org/CVERecord?id=CVE-2022-31799
- https://www.debian.org/security/2022/dsa-5159