Homepage

HTTP Request Smuggling The advisory has been revoked - it doesn't affect any version of package waitress  (opens in a new tab)

Threat Intelligence

EPSS
2.54% (84th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1904-WAITRESS-541216
  • published24 Dec 2019
  • disclosed20 Dec 2019
Report a new vulnerability Found a mistake?

Introduced: 20 Dec 2019

CVE-2019-16785  (opens in a new tab)
CWE-444  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:19.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream waitress package and not the waitress package as distributed by Ubuntu.

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.

References