CVE-2019-16786

CVE	CVE-2019-16786
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-12-20 23:15:00 UTC
Updated	2023-11-07 03:05:00 UTC
Description	Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Problem Types: CWE-444

Type	Vendor	Product	Version	Update	Edition	Language
Application	Agendaless	Waitress	All	All	All	All
Application	Agendaless	Waitress	All	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	30	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Application	Oracle	Communications Cloud Native Core Network Function Cloud Native Environment	1.10.0	All	All	All
Application	Redhat	Openstack	15	All	All	All

Reference	Source	Link	Tags
[SECURITY] [DLA 3000-1] waitress security update	MLIST	lists.debian.org
Red Hat Customer Portal	REDHAT	access.redhat.com
[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Oracle Critical Patch Update Advisory - April 2022	MISC	www.oracle.com
[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Merge pull request from GHSA-g2xc-35jw-c63p · Pylons/waitress@f11093a · GitHub	MISC	github.com	Patch, Third Party Advisory
[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
HTTP Request Smuggling: Invalid Transfer-Encoding · Advisory · Pylons/waitress · GitHub	CONFIRM	github.com	Third Party Advisory
Waitress — waitress 2.0.0 documentation	MISC	docs.pylonsproject.org	Release Notes, Vendor Advisory
[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

174724 SUSE Enterprise Linux Security update for python-waitress (SUSE-SU-2020:3269-1)
179276 Debian Security Update for waitress (DLA 3000-1)
296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
501368 Alpine Linux Security Update for py3-waitress
750599 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1922-1)
750606 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1911-1)
983107 Python (pip) Security Update for waitress (GHSA-g2xc-35jw-c63p)