CVE-2020-28473

Name	CVE-2020-28473
Description	The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2531-1, ELA-350-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-bottle (PTS)	jessie, jessie (lts)	0.12.7-1+deb8u4	fixed
	stretch (security), stretch (lts), stretch	0.12.13-1+deb9u2	fixed
	buster, buster (security)	0.12.15-2+deb10u2	fixed
	bullseye (security), bullseye	0.12.19-1+deb11u1	fixed
	bookworm	0.12.23-1.1	fixed
	sid, trixie	0.12.25-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
python-bottle	source	jessie	0.12.7-1+deb8u3	ELA-350-1
python-bottle	source	stretch	0.12.13-1+deb9u1	DLA-2531-1
python-bottle	source	buster	0.12.15-2+deb10u1
python-bottle	source	(unstable)	0.12.19-1

Notes

https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108
Fixed by: https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b (0.12.19)