Skip to content
OpenAdvisories
Medium DSA-3743-1 1 CVE

python-bottle - security update

Published Dec 20, 2016 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 python-bottle 0.12.7-1+deb8u1

Vulnerabilities 1

  • Medium 6.5
    CVE-2016-9964

    bottle.py vulnerable to CRLF Injection

    redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

    bottle python-bottle python-bottle Debian Ubuntu PyPI