It was reported that the JSON content-type was not restrictive enough. Bottle treated "text/plain;application/json" as JSON, allowing attackers to bypass intended security mechanisms. From the upstream report, "For example Chrome will not allow cross-origin xmlhttprequests with the content type set to "application/json" but you can set it to "text/plain;application/json" instead and bottle will accept it.".
Upstream report: https://github.com/defnull/bottle/issues/616
Patches for master, 0.11, and 0.12, respectively:
Created python-bottle tracking bugs for this issue:
Affects: fedora-all [bug 1093257]
CVE request: http://www.openwall.com/lists/oss-security/2014/05/01/10
MITRE assigned CVE-2014-3137 to this issue:
python-bottle-0.12.6-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
python-bottle-0.12.6-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.