Homepage

Missing Release of Resource after Effective Lifetime The advisory has been revoked - it doesn't affect any version of package python-waitress  (opens in a new tab)

Threat Intelligence

EPSS
1.38% (70th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-PYTHONWAITRESS-8318151
  • published31 Oct 2024
  • disclosed29 Oct 2024
Report a new vulnerability Found a mistake?

Introduced: 29 Oct 2024

CVE-2024-49769  (opens in a new tab)
CWE-772  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-waitress package and not the python-waitress package as distributed by RHEL.

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.