Bug 509350 – <dev-python/bottle-{0.11.7,0.12.6}: JSON content-type not restrictive enough (CVE-2014-3137)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-05-02 07:56:53 UTC]

From ${URL} :

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746322 and 
https://github.com/defnull/bottle/issues/616 report an issue where 
Bottle treated "text/plain;application/json" as JSON, allowing security 
mechanisms to be bypassed.

 From the upstream report, "For example Chrome will not allow 
cross-origin xmlhttprequests with the content type set to 
"application/json" but you can set it to "text/plain;application/json" 
instead and bottle will accept it."



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Manuel Rüger (RETIRED) 2014-06-06 14:49:25 UTC]

CVE-2014-3137 assigned.

[Comment 2 Dirkjan Ochtman (RETIRED) 2014-06-06 15:48:07 UTC]

I've added 0.11.7 and 0.12.6 to the tree, I'd like to have 0.11.7 stabilized.

[Comment 3 Kristian Fiskerstrand (RETIRED) 2014-06-29 09:53:26 UTC]

Thank you. 

Arches, please stabilize:
=dev-python/bottle-0.11.7

Targets: alpha amd64 arm ia64 ppc ppc64 sparc x86

[Comment 4 Myckel Habets 2014-06-29 14:11:05 UTC]

Builds fine on x86. please mark stable for x86.

[Comment 5 Agostino Sarubbo 2014-07-04 19:32:44 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2014-07-05 11:24:37 UTC]

x86 stable

[Comment 7 Agostino Sarubbo 2014-07-05 11:33:27 UTC]

alpha stable

[Comment 8 Agostino Sarubbo 2014-07-05 12:39:47 UTC]

ia64 stable

[Comment 9 Agostino Sarubbo 2014-07-05 12:51:38 UTC]

ppc64 stable

[Comment 10 Agostino Sarubbo 2014-07-05 12:54:37 UTC]

ppc stable

[Comment 11 Agostino Sarubbo 2014-07-05 12:56:17 UTC]

sparc stable

[Comment 12 Markus Meier 2014-07-06 17:44:03 UTC]

arm stable, all arches done!

[Comment 13 Mikle Kolyada (RETIRED) 2014-07-09 10:31:46 UTC]

Cleanup, please!

GLSA vote: no.

[Comment 14 Yury German 2014-07-10 05:48:39 UTC]

Arches, Thank you for your work
Maintainer(s), please drop the vulnerable version.

GLSA Vote: No

[Comment 15 Chris Reffett (RETIRED) 2014-08-25 22:46:04 UTC]

Maintainer timeout, cleanup done, closing noglsa.