CVE-2016-9964 bottle.py vulnerable to CRLF Injection

Medium 6.5 Published 16 Dec 2016 Updated 6 Aug 2024

Attackers can inject CRLF sequences into HTTP headers via the redirect function, potentially enabling header injection attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-9964?

CVE-2016-9964 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Dec 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

Weakness: CWE-93

Which versions are affected by CVE-2016-9964?

3 open source packages ship an affected version, including bottle. It affects 2 products.

Package	Affected	Fixed in
`bottle` PyPI	From `0.10.1`	`0.12.11`
`bottle` PyPI	From `0.10.1`	`0.12.11`
`bottle` PyPI	From `0.10.1`	`0.12.11`

Products include Bottlepy Bottle, Debian Debian Linux.

How do I fix CVE-2016-9964?

Upgrade bottle to 0.12.11 or later.

Is CVE-2016-9964 being exploited?

There is no known exploitation of CVE-2016-9964 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-9964, DLA-761-1, DSA-3743-1, GHSA-j6f7-hghw-g437, MGASA-2017-0031, PYSEC-2016-24 and 2 more.