Log in Start free

Vulnerability · Published May 29, 2022 · Assigned by mitre

CVE-2022-31799

Critical 9.8

In plain English

A critical-severity security flaw in the py3-bottle package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.1%top 17.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Bottle before 0.12.20 mishandles errors during early request binding.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-bottle0.12.21-r0ALPINE-CVE-2022-31799
Alpine:v3.21py3-bottle0.12.21-r0ALPINE-CVE-2022-31799
Alpine:v3.22py3-bottle0.12.21-r0ALPINE-CVE-2022-31799
Alpine:v3.23py3-bottle0.12.21-r0ALPINE-CVE-2022-31799
Alpine:v3.24py3-bottle0.12.21-r0ALPINE-CVE-2022-31799
Debian:12python-bottle0.12.20-1DEBIAN-CVE-2022-31799
Debian:13python-bottle0.12.20-1DEBIAN-CVE-2022-31799
Debian:14python-bottle0.12.20-1DEBIAN-CVE-2022-31799
PyPIbottle0.12.20PYSEC-2022-227
PyPIbottle0.12.20GHSA-xhp9-4947-rq78
Ubuntu:22.04:LTSpython-bottle0.12.19-1+deb11u1build0.22.04.1UBUNTU-CVE-2022-31799
Ubuntu:22.04:LTSpython-bottle0.12.19-1+deb11u1build0.22.04.1USN-5532-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References