CVE-2022-31799
Bottle before 0.12.20 mishandles errors during early request binding.
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Amazon (high), Ubuntu (medium).
Description
Bottle before 0.12.20 mishandles errors during early request binding.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | bottle | 0.12.20 |
| alpine 3.16 | py3-bottle | 0.12.21-r0 |
| alpine 3.17 | py3-bottle | 0.12.21-r0 |
| alpine 3.18 | py3-bottle | 0.12.21-r0 |
| alpine 3.19 | py3-bottle | 0.12.21-r0 |
| alpine 3.20 | py3-bottle | 0.12.21-r0 |
| alpine 3.21 | py3-bottle | 0.12.21-r0 |
| alpine 3.22 | py3-bottle | 0.12.21-r0 |
| alpine 3.23 | py3-bottle | 0.12.21-r0 |
| alpine 3.24 | py3-bottle | 0.12.21-r0 |
| alpine edge | py3-bottle | 0.12.21-r0 |
| amazon linux 2 | python3-bottle | 0.12.21-2.amzn2 |
Show all 28 entries from 28 sources
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | bottle | 0.12.20 |
| alpine 3.16 | py3-bottle | 0.12.21-r0 |
| alpine 3.17 | py3-bottle | 0.12.21-r0 |
| alpine 3.18 | py3-bottle | 0.12.21-r0 |
| alpine 3.19 | py3-bottle | 0.12.21-r0 |
| alpine 3.20 | py3-bottle | 0.12.21-r0 |
| alpine 3.21 | py3-bottle | 0.12.21-r0 |
| alpine 3.22 | py3-bottle | 0.12.21-r0 |
| alpine 3.23 | py3-bottle | 0.12.21-r0 |
| alpine 3.24 | py3-bottle | 0.12.21-r0 |
| alpine edge | py3-bottle | 0.12.21-r0 |
| amazon linux 2 | python3-bottle | 0.12.21-2.amzn2 |
| amazon linux 2022 | python3-bottle | 0.12.21-2.amzn2022 |
| amazon linux 2023 | python3-bottle | 0.12.21-2.amzn2023.0.1 |
| debian 10 | python-bottle | 0.12.15-2+deb10u2 |
| debian 11 | python-bottle | 0.12.19-1+deb11u1 |
| debian 12 | python-bottle | 0.12.20-1 |
| debian 13 | python-bottle | 0.12.20-1 |
| debian 14 | python-bottle | 0.12.20-1 |
| debian 9 | python-bottle | 0.12.13-1+deb9u2 |
| echo | python-bottle | 0.12.20-1 |
| ubuntu 14.04-ESM | python-bottle | 0.12.0-1ubuntu0.1~esm3 |
| ubuntu 16.04-ESM | python-bottle | 0.12.7-1+deb8u1ubuntu0.1~esm1 |
| ubuntu 18.04 | python-bottle | 0.12.13-1ubuntu0.2 |
| ubuntu 18.04-ESM | python-bottle | 0.12.13-1ubuntu0.2 |
| ubuntu 20.04 | python-bottle | 0.12.15-2.1ubuntu0.2 |
| ubuntu 20.04-ESM | python-bottle | 0.12.15-2.1ubuntu0.2 |
| ubuntu 22.04 | python-bottle | 0.12.19-1+deb11u1build0.22.04.1 |
References
- https://github.com/advisories/GHSA-xhp9-4947-rq78
- https://github.com/bottlepy/bottle
- https://github.com/bottlepy/bottle/commit/a2b0ee6bb4ce88895429ec4aca856616244c4c4c
- https://github.com/bottlepy/bottle/commit/e140e1b54da721a660f2eb9d58a106b7b3ff2f00
- https://github.com/bottlepy/bottle/compare/0.12.19...0.12.20
- https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2022-227.yaml
- https://lists.debian.org/debian-lts-announce/2022/06/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD
All 16 references
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTLOQGMDZEPIYTFC2G53OQV2ULCGYS3F
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTLOQGMDZEPIYTFC2G53OQV2ULCGYS3F/
- https://nvd.nist.gov/vuln/detail/CVE-2022-31799
- https://ubuntu.com/security/notices/USN-5532-1
- https://ubuntu.com/security/notices/USN-5532-2
- https://www.cve.org/CVERecord?id=CVE-2022-31799
- https://www.debian.org/security/2022/dsa-5159