Read the docs
Red Hat Security Advisory

RHSA-2020:0720

python-waitress security update

Released 2020-03-05 · Red Hat rating Low · View on Red Hat →

Fixed in

Fixes 3 records

TI-2019-12566 CVE-2019-16789 · GHSA-968f-66r5-5v74

HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

Priority MEDIUM 41

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential fo…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02587 Published 2019-12-26 Partial fix · 1.4.1, 1.4.2 CWE-444
TI-2019-12564 CVE-2019-16785 · GHSA-pg36-wpm5-g57p

HTTP Request Smuggling: LF vs CRLF handling in Waitress

Priority LOW 38

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a lin…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02537 Published 2019-12-20 Partial fix · 1.4.0 CWE-444
TI-2019-12565 CVE-2019-16786 · GHSA-g2xc-35jw-c63p

HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

Priority LOW 37

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02379 Published 2019-12-20 Partial fix · 1.4.0 CWE-444