HTTP Response Splitting Affecting waitress package, versions [,0.9.0b1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-WAITRESS-564339
- published 1 Apr 2020
- disclosed 17 Mar 2016
- credit Jason Madden
How to fix?
Upgrade waitress to version 0.9.0b1 or higher.
Overview
waitress is a production-quality pure-Python WSGI server with very acceptable performance.
Affected versions of this package are vulnerable to HTTP Response Splitting. Lack of validating for line feed/carriage return HTTP Response Splitting in the status line, as well as the key of a header.
References
CVSS Scores
version 3.1