CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-31799
Critical (9.8). EPSS 2.1% chance of exploitation in the next 30 days. Fixed in bottle 0.12.20.
Bottle before 0.12.20 mishandles errors during early request binding.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bottlepy:bottle
- debian:debian_linux
- fedoraproject:fedora
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xhp9-4947-rq78 | PyPI | bottle | <0.12.20 | 0.12.20 |
| PYSEC-2022-227 | PyPI | bottle | <0.12.20 | 0.12.20 |
References
- https://github.com/bottlepy/bottle/commit/a2b0ee6bb4ce88895429ec4aca856616244c4c4c
- https://github.com/bottlepy/bottle/commit/e140e1b54da721a660f2eb9d58a106b7b3ff2f00
- https://github.com/bottlepy/bottle/compare/0.12.19...0.12.20
- https://lists.debian.org/debian-lts-announce/2022/06/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD/