CVE-2014-3137 Bottle does not properly limit content-types

Medium 6.8 Published 25 Oct 2014 Updated 6 Aug 2024

Remote attackers can bypass content-type restrictions in the Bottle web framework to execute arbitrary code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-3137?

CVE-2014-3137 is a medium-severity vulnerability in n/a, published on 25 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

Weakness: CWE-20

Which versions are affected by CVE-2014-3137?

7 open source packages ship an affected version, including bottle. It affects 1 product.

Package	Affected	Fixed in
`bottle` PyPI	From `0.10.0`	`0.10.12`
`bottle` PyPI	From `0.10.0`	`0.10.12`
`bottle` PyPI	From `0.11.0`	`0.11.7`
`bottle` PyPI	From `0.11.0`	`0.11.7`
`bottle` PyPI	From `0.12.0`	`0.12.6`
`bottle` PyPI	From `0.12.0`	`0.12.6`

1 more packages

bottle PyPI From 0.8 0.10.12, 0.11.7, 0.12.6

Products include Bottlepy Bottle.

How do I fix CVE-2014-3137?

Upgrade bottle to a fixed version for your release line: 0.10.12, 0.11.7 or 0.12.6.

Is CVE-2014-3137 being exploited?

There is no known exploitation of CVE-2014-3137 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-3137, DSA-2948-1, GHSA-873q-wpqr-xfgw, PYSEC-2014-77, UBUNTU-CVE-2014-3137.