PT-2019-20155 · Waitress · Waitress

Published 2019-12-26 · Updated 2019-12-26

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Waitress versions prior to 1.4.1

Description The issue allows an attacker to send specially crafted requests containing special whitespace characters in the Transfer-Encoding header, which could be parsed differently by Waitress and a front-end server. This discrepancy can lead to HTTP request splitting when a front-end server uses HTTP pipelining to a backend Waitress server, potentially resulting in cache poisoning or unexpected information disclosure.

Recommendations For versions prior to 1.4.1, update to Waitress version 1.4.1 or later, which includes more strict HTTP field validation to address this issue.

Related Identifiers

PYSEC-2019-68

Affected Products

Waitress

References · 7

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-68 · Vendor Advisory
• https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017 · Note
• ❌ https://github.com/github/advisory-review/pull/14604 · Note, Deleted
• https://access.redhat.com/errata/RHSA-2020:0720 · Note
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes · Note