Security Bulletin: IBM Storage Ceph is vulnerable to Time-of-check Time-of-use in python-waitress (CVE-2024-49768)

Summary python-waitress is used by IBM Storage Ceph. CVE-2024-49768 Vulnerability Details CVEID:CVE-2024-49768 DESCRIPTION: Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a...

TencentOS Server 4: python-waitress (TSSA-2024:1044)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1044 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

EUVD-2019-0157

Malware in sbrugna...

EUVD-2020-0239

Malware in sbrugna...

EUVD-2019-0156

Malware in sbrugna...

EUVD-2019-0158

Malware in sbrugna...

EUVD-2022-0358

Malicious code in bioql PyPI...

EUVD-2022-0359

Malicious code in bioql PyPI...

EUVD-2024-0187

Malicious code in bioql PyPI...

EUVD-2024-0188

Malicious code in bioql PyPI...

ROS-20250922-10

A vulnerability in the getpeername function of the WSGI server for python Waitress is related to the non-release of a resource after a valid exploitation period has expired. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2019-16785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Waitress through version 1.3.1 implemented a MAY part of the RFC7230 which states: Although the line terminator for the start-line and header fields is the...

Linux Distros Unpatched Vulnerability : CVE-2019-16786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall...

Linux Distros Unpatched Vulnerability : CVE-2019-16789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and...

Linux Distros Unpatched Vulnerability : CVE-2019-16792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header an...

Security Bulletin: Waitress WSGI Server Vulnerability: HTTP Pipelining Request Handling with Disabled Lookahead

Summary Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and...

Fedora: Security Advisory (FEDORA-2024-157678aad0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

python311-waitress-3.0.2-1.4 on GA media (moderate)

python311-waitress-3.0.2-1.4 on GA media Announcement ID: openSUSE-SU-2025:15108-1 Rating: moderate Cross-References: CVE-2022-24761 CVE-2022-31015 CVSS scores: CVE-2022-24761 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-31015 SUSE : 5.3...

OPENSUSE-SU-2025:15108-1 python311-waitress-3.0.2-1.4 on GA media

These are all security issues fixed in the python311-waitress-3.0.2-1.4 package on the GA media of openSUSE Tumbleweed...

CVE-2022-24761 affecting package python-waitress for versions less than 3.0.1-1

CVE-2022-24761 affecting package python-waitress for versions less than 3.0.1-1. An upgraded version of the package is available that resolves this issue...