CVE-2019-16785

CVE	CVE-2019-16785
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-12-20 23:15:00 UTC
Updated	2023-11-07 03:05:00 UTC
Description	Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.

Problem Types: CWE-444

Type	Vendor	Product	Version	Update	Edition	Language
Application	Agendaless	Waitress	All	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	30	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Application	Oracle	Communications Cloud Native Core Network Function Cloud Native Environment	1.10.0	All	All	All
Application	Redhat	Openstack	15	All	All	All

Reference	Source	Link	Tags
HTTP Request Smuggling: LF vs CRLF handling in Waitress · Advisory · Pylons/waitress · GitHub	CONFIRM	github.com	Exploit, Third Party Advisory
[SECURITY] [DLA 3000-1] waitress security update	MLIST	lists.debian.org
Red Hat Customer Portal	REDHAT	access.redhat.com
[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Oracle Critical Patch Update Advisory - April 2022	MISC	www.oracle.com
[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Waitress — waitress 2.0.0 documentation	MISC	docs.pylonsproject.org	Vendor Advisory
[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Remove support for non CRLF line endings · Pylons/waitress@8eba394 · GitHub	MISC	github.com	Patch, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

174724 SUSE Enterprise Linux Security update for python-waitress (SUSE-SU-2020:3269-1)
179276 Debian Security Update for waitress (DLA 3000-1)
296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
501368 Alpine Linux Security Update for py3-waitress
750599 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1922-1)
750606 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1911-1)
983108 Python (pip) Security Update for waitress (GHSA-pg36-wpm5-g57p)