7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
67.4%
Waitress would header fold a double Content-Length
header and due to being unable to cast the now comma separated value to an integer would set the Content-Length
to 0 internally.
So a request with:
Content-Length: 10
Content-Length: 10
would get transformed to:
Content-Length: 10, 10
Which would Waitress would then internally set to Content-Lenght: 0
.
Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.
This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies.
The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don’t cause any changes in behavior.
Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn’t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent… so this is not a fool proof security method).
docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes
github.com/advisories/GHSA-j7j6-7hfx-5522
github.com/Pylons/waitress
github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65
github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6
github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2020-178.yaml
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
67.4%