6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:N/A:C
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
33.0%
Waitress version 1.4.2 allows a DOS attack When waitress receives a header
that contains invalid characters. When a header like “Bad-header:
xxxxxxxxxxxxxxx\x10” is received, it will cause the regular expression
engine to catastrophically backtrack causing the process to use 100% CPU
time and blocking any other interactions. This allows an attacker to send a
single request with an invalid header and take the service offline. This
issue was introduced in version 1.4.2 when the regular expression was
updated to attempt to match the behaviour required by errata associated
with RFC7230. The regular expression that is used to validate incoming
headers has been updated in version 1.4.3, it is recommended that people
upgrade to the new version of Waitress as soon as possible.
Author | Note |
---|---|
mdeslaur | introduced in 1.4.2 |
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:N/A:C
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
33.0%