PT-2019-6234 · Waitress+3 · Waitress+3
CVE-2019-16789
·
Publicado
2019-12-24
·
Atualizado
2022-09-23
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Waitress versions 1.4.0 and earlier
Description
The issue is related to the incorrect handling of special whitespace characters in the
Transfer-Encoding header, which can lead to HTTP request smuggling and potentially result in cache poisoning or unexpected information disclosure. This can occur when a proxy server is used in front of Waitress and an attacker sends a specially crafted request. The vulnerability allows a remote attacker to access and compromise confidential data using a specially created request.Recommendations
For Waitress versions 1.4.0 and earlier, upgrade to Waitress version 1.4.1 or later, with version 1.4.2 being the recommended version as it includes improved HTTP header validation to completely fix the issue.
As a temporary workaround, consider restricting access to the
Transfer-Encoding header to minimize the risk of exploitation.Correção
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Suse
Waitress