CVE-2014-3137

Name	CVE-2014-3137
Description	Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2948-1
Debian Bugs	746322

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-bottle (PTS)	bullseye (security), bullseye	0.12.19-1+deb11u1	fixed
	bookworm	0.12.23-1.1	fixed
	trixie	0.12.25-1	fixed
	sid	0.13.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
python-bottle	source	squeeze	(not affected)
python-bottle	source	wheezy	0.10.11-1+deb7u1	DSA-2948-1
python-bottle	source	(unstable)	0.12.6-1		746322

[squeeze] - python-bottle <not-affected> (bug affects versions 0.10.11-1 and 0.12.5-1)