CVE-2019-16789

CVE	CVE-2019-16789
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-12-26 17:15:00 UTC
Updated	2023-11-07 03:05:00 UTC
Description	In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

Problem Types: CWE-444

Type	Vendor	Product	Version	Update	Edition	Language
Application	Agendaless	Waitress	All	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	30	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Application	Oracle	Communications Cloud Native Core Network Function Cloud Native Environment	1.10.0	All	All	All
Application	Redhat	Openstack	15	All	All	All

Reference	Source	Link	Tags
[SECURITY] [DLA 3000-1] waitress security update	MLIST	lists.debian.org
Red Hat Customer Portal	REDHAT	access.redhat.com
[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Merge pull request from GHSA-m5ff-3wj3-8ph4 · Pylons/waitress@11d9e13 · GitHub	MISC	github.com	Patch, Third Party Advisory
Oracle Critical Patch Update Advisory - April 2022	MISC	www.oracle.com
[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
github.com/github/advisory-review/pull/14604	CONFIRM	github.com	Broken Link, Third Party Advisory
Waitress — waitress 2.0.0 documentation	MISC	docs.pylonsproject.org	Release Notes, Vendor Advisory
[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

174724 SUSE Enterprise Linux Security update for python-waitress (SUSE-SU-2020:3269-1)
179276 Debian Security Update for waitress (DLA 3000-1)
296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
501369 Alpine Linux Security Update for py3-waitress
750599 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1922-1)
750606 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1911-1)
983109 Python (pip) Security Update for waitress (GHSA-968f-66r5-5v74)