CVE-2019-16786
Description
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
How to fix
- agendaless waitress1.3.1 or later
- waitress1.4.0, 1.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| agendaless waitress | v < 1.3.1 | 1.3.1 |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | — |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 30, 31 | — |
| redhat openstack | 15 | — |
| waitressPyPI | v < 1.4.0, v < 1.3.1 | 1.4.0, 1.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.