Time-of-check Time-of-use (TOCTOU) Race Condition Affecting waitress package, versions [2.0.0,3.0.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-WAITRESS-8309636
- published 29 Oct 2024
- disclosed 29 Oct 2024
- credit m4yfly, urn1ce
Introduced: 29 Oct 2024
New CVE-2024-49768 Open this link in a new tabHow to fix?
Upgrade waitress to version 3.0.1 or higher.
Overview
waitress is a production-quality pure-Python WSGI server with very acceptable performance.
Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in HTTP pipelining when handling an invalid initial request. An attacker can exploit this vulnerability to process unauthorized requests by sending a specially crafted sequence of requests where the first request is exactly recv_bytes long and followed by a secondary request using HTTP pipelining.
Workaround
This vulnerability can be mitigated by disabling channel_request_lookahead, which is set to 0 by default, thus disabling this feature.