PT-2019-20153 · Waitress · Waitress

Published 2019-12-20 · Updated 2019-12-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Waitress versions 1.3.1 and earlier

Description The issue arises from the implementation of a part of the RFC7230 in Waitress, where it recognizes a single LF as a line terminator and ignores any preceding CR. This can cause a discrepancy in how the front-end and back-end servers parse HTTP messages, potentially leading to HTTP request smuggling or splitting. This discrepancy occurs when the front-end server does not parse header fields with an LF in the same way as it does those with a CRLF.

Recommendations For Waitress versions 1.3.1 and earlier, update to version 1.4.0 to resolve the issue.

Related Identifiers

PYSEC-2019-66

Affected Products

Waitress

References · 7

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-66 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7 · Vendor Advisory
• https://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba · Note
• https://github.com/Pylons/waitress/security/advisories/GHSA-pg36-wpm5-g57p · Note
• https://access.redhat.com/errata/RHSA-2020:0720 · Note
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes · Note