CVE-2019-16786 HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

2019-12-2023:00:20

CWE-444

GitHub_M

www.cve.org

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.2%

JSON

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: “Transfer-Encoding: gzip, chunked” would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.

CNA Affected

[
  {
    "product": "Waitress",
    "vendor": "Pylons",
    "versions": [
      {
        "lessThanOrEqual": "1.3.1",
        "status": "affected",
        "version": "<= 1.3.1",
        "versionType": "custom"
      }
    ]
  }
]