CVE-2019-16792
Summary
| CVE | CVE-2019-16792 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-01-22 19:15:00 UTC |
|---|
| Updated | 2022-09-23 18:58:00 UTC |
|---|
| Description | Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Upon receiving invalid Content-Length bail · Pylons/waitress@575994c · GitHub |
MISC |
github.com |
Patch |
| [SECURITY] [DLA 3000-1] waitress security update |
MLIST |
lists.debian.org |
|
| HTTP Request Smuggling: Content-Length Sent Twice · Advisory · Pylons/waitress · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| Oracle Critical Patch Update Advisory - April 2022 |
MISC |
www.oracle.com |
|
| Waitress — waitress 2.0.0 documentation |
MISC |
docs.pylonsproject.org |
Release Notes |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 174724 SUSE Enterprise Linux Security update for python-waitress (SUSE-SU-2020:3269-1)
- 179276 Debian Security Update for waitress (DLA 3000-1)
- 296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
- 750599 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1922-1)
- 750606 OpenSUSE Security Update for python-waitress (openSUSE-SU-2020:1911-1)
