{"id":"CVE-2020-28473","aliases":["DEBIAN-CVE-2020-28473","DLA-2531-1","EUVD-2021-0038","GHSA-qhx9-7hx7-cp4r","MGASA-2021-0171","OESA-2021-1067","PYSEC-2021-129","SNYK-PYTHON-BOTTLE-1017108","SUSE-SU-2021:0483-1","UBUNTU-CVE-2020-28473","USN-5105-1","openSUSE-SU-2021:0302-1","openSUSE-SU-2024:13210-1"],"status":"published","title":"Web Cache Poisoning","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01786,"percentile":0.78504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2021-01-18T11:15:14Z","modified":"2026-10-26T12:02:43Z","fixes":[{"ecosystem":"PyPI","package":"bottle","fixed_in":["0.12.19"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-bottle","fixed_in":["0.12.19-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-bottle","fixed_in":["0.12.19-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-bottle","fixed_in":["0.12.19-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"python-bottle","fixed_in":["0.12.13-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-bottle","fixed_in":["0.12.16-1.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"python-bottle","fixed_in":["0.12.13-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-bottle","fixed_in":["0.12.13-8.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"python-bottle","fixed_in":["0.12.13-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"python-bottle","fixed_in":["0.12.13-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-bottle","fixed_in":["0.12.0-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-bottle","fixed_in":["0.12.13-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-bottle","fixed_in":["0.12.15-2.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"python-bottle","fixed_in":["0.12.13-lp152.4.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-1+deb9u1"}]}],"versions":["0.12.13-1"]},{"source":"osv","ecosystem":"PyPI","package":"bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19"}]}],"versions":["0.10.1","0.10.10","0.10.11","0.10.12","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.14","0.12.15","0.12.16","0.12.17","0.12.18","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.3","0.4.4","0.4.6","0.4.7","0.4.8","0.4.9","0.5.3","0.5.4","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.16-1.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-8.oe1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19"}]}],"versions":["0.10.1","0.10.10","0.10.11","0.10.12","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.14","0.12.15","0.12.16","0.12.17","0.12.18","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.3","0.4.4","0.4.6","0.4.7","0.4.8","0.4.9","0.5.3","0.5.4","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1ubuntu0.1~esm2"}]}],"versions":["0.11.6-1","0.12.0-1","0.12.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.7-1","0.12.7-1+deb8u1build0.16.04.1","0.12.7-1+deb8u1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-1ubuntu0.1"}]}],"versions":["0.12.13-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.15-2.1ubuntu0.1"}]}],"versions":["0.12.15-2","0.12.15-2build1","0.12.15-2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.19-1","0.12.19-1+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-1ubuntu0.1"}]}],"versions":["0.12.13-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.15-2.1ubuntu0.1"}]}],"versions":["0.12.15-2","0.12.15-2build1","0.12.15-2.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-bottle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-lp152.4.3.1"}]}]}],"products":[{"vendor":"bottlepy","product":"bottle"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory","report"]},{"url":"https://github.com/bottlepy/bottle","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","web","report"]},{"url":"https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28473","tags":["advisory"]},{"url":"https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qhx9-7hx7-cp4r","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2021-129.yaml","tags":["web"]},{"url":"https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28473","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0171.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28219","tags":["report"]},{"url":"https://www.debian.org/lts/security/2021/dla-2531","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1067","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210483-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182181","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28473","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-28473","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5105-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28473","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NH4G4ACMTOHQQPWHAFALRZDCUZ5J46OZ/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31799","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-28473","title":"Web Cache Poisoning","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T11:15:14.918Z","modified":"2024-09-16T20:41:35.337Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2021-0038","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T11:15:14Z","modified":"2024-09-16T20:41:35Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:55:12.113193Z"}],"ghsa":[{"id":"GHSA-qhx9-7hx7-cp4r","title":"bottle HTTP Request smuggling","description":"The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-04-07T21:05:21Z","modified":"2024-09-13T14:20:38Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2020-28473","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T12:15:12.707Z","modified":"2026-06-17T03:10:30.793Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"CVE-2020-28473","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T12:15:12.707Z","modified":"2026-10-20T10:54:19.441466471Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-28473","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T12:15:12.707Z","modified":"2026-10-26T12:02:43.36402193Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-qhx9-7hx7-cp4r","title":"bottle HTTP Request smuggling","description":"The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-04-07T21:05:21Z","modified":"2024-09-13T14:45:31.941471Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"},{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"OESA-2021-1067","title":"python-bottle security update","description":"Bottle is a fast, simple and lightweight WSGI micro web-framework for Python. It is distributed as a single file module and has no dependencies other than the Python Standard Library.\r\n\r\nSecurity Fix(es):\r\n\r\nThe package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.(CVE-2020-28473)","status":"published","published":"2021-03-05T11:04:17Z","modified":"2026-08-18T01:15:16.967491122Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-28473","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T12:15:00Z","modified":"2026-02-04T03:05:41.374428Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2531-1","title":"python-bottle - security update","status":"published","published":"2021-01-24T00:00:00Z","modified":"2026-03-09T01:21:37.732586Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0171","title":"Updated python-bottle packages fix security vulnerability","description":"Updated python-bottle packages fix security vulnerability:\n\npython-bottle before 0.12.19 is vulnerable to Web Cache Poisoning by using\na vector called parameter cloaking. When the attacker can separate query\nparameters using a semicolon (;), they can cause a difference in the\ninterpretation of the request between the proxy (running with default\nconfiguration) and the server. This can result in malicious requests being\ncached as completely safe ones, as the proxy would usually not see the\nsemicolon as a separator, and therefore would not include it in a cache key\nof an unkeyed parameter (CVE-2020-28473).\n","status":"published","published":"2021-04-02T20:25:05Z","modified":"2026-04-16T04:43:18.764090137Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0302-1","title":"Security update for python-bottle","description":"This update for python-bottle fixes the following issues:\n\n- CVE-2020-28473: Fixed Web Cache Poisoning vulnerability using parameter cloaking (bsc#1182181).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-02-16T15:21:48Z","modified":"2025-05-07T18:12:02.605848Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:13210-1","title":"python-bottle-doc-0.12.25-5.1 on GA media","description":"These are all security issues fixed in the python-bottle-doc-0.12.25-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:12.5981Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"PYSEC-2021-129","description":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","status":"published","published":"2021-01-18T12:15:00Z","modified":"2023-11-08T04:03:27.869657Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-SU-2021:0483-1","title":"Security update for python-bottle","description":"This update for python-bottle fixes the following issues:\n\n- CVE-2020-28473: Fixed Web Cache Poisoning vulnerability using parameter cloaking (bsc#1182181).\n","status":"published","published":"2021-02-16T09:04:52Z","modified":"2026-02-04T03:22:54.426957Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-5105-1","title":"python-bottle vulnerability","description":"It was discovered that Bottle incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cache malicious requests.\n","status":"published","published":"2021-10-06T16:54:36Z","modified":"2026-04-27T15:57:05.944569Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}