CVE-2022-31799 (High) detected in bottle-0.12.18-py3-none-any.whl - autoclosed

[mend-for-github-com[bot]]

CVE-2022-31799 - High Severity Vulnerability

Vulnerable Library - bottle-0.12.18-py3-none-any.whl

Fast and simple WSGI-framework for small web-applications.

Library home page: https://files.pythonhosted.org/packages/e9/39/2bf3a1fd963e749cdbe5036a184eda8c37d8af25d1297d94b8b7aeec17c4/bottle-0.12.18-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **bottle-0.12.18-py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: 85f56e10156087bb76d88c8d68df7a3498c64cd7

Found in base branch: main

Vulnerability Details

Bottle before 0.12.20 mishandles errors during early request binding.

Publish Date: 2022-06-02

URL: CVE-2022-31799

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-02

Fix Resolution: bottle - 0.12.20

---

:rescue_worker_helmet: Automatic Remediation is available for this issue

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.