CVE-2019-16785
published 2019-12-20CVE-2019-16785: Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
2.71%
84.3th percentile
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| agendaless | waitress | <= 1.3.1 | — |
| debian | debian_linux | — | — |
| debian | waitress | < waitress 1.4.1-1 (bookworm) | waitress 1.4.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | — | — |
| pylons | waitress | <= 1.3.1 | — |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.0 | 1.4.0 |
| redhat | openstack | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
waitress: HTTP request smuggling through LF vs CRLF handling
vendor_redhat·2019-12-20·CVSS 7.1
CVE-2019-16785 [HIGH] CWE-444 waitress: HTTP request smuggling through LF vs CRLF handling
waitress: HTTP request smuggling through LF vs CRLF handling
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
An HTTP-request vulnerability was discovered in
Debian
CVE-2019-16785: waitress - Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which sta...
vendor_debian·2019·CVSS 7.1
CVE-2019-16785 [HIGH] CVE-2019-16785: waitress - Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which sta...
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
Scope: local
bookworm: resolved (fixed in 1.4.1-1)
bullseye: resolved (fixed in 1.4.1-1)
forky: resolved (fixe
OSV
CVE-2019-16785: Waitress through version 1
osv·2019-12-20·CVSS 7.5
CVE-2019-16785 [HIGH] CVE-2019-16785: Waitress through version 1
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
GHSA
HTTP Request Smuggling: LF vs CRLF handling in Waitress
ghsa·2019-12-20
CVE-2019-16785 [MEDIUM] CWE-444 HTTP Request Smuggling: LF vs CRLF handling in Waitress
HTTP Request Smuggling: LF vs CRLF handling in Waitress
### Impact
Waitress implemented a "MAY" part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:
Although the line terminator for the start-line and header fields is
the sequence CRLF, a recipient MAY recognize a single LF as a line
terminator and ignore any preceding CR.
Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.
Example:
```
Content-Length: 100[CRLF]
X-Header: x
OSV
HTTP Request Smuggling: LF vs CRLF handling in Waitress
osv·2019-12-20
CVE-2019-16785 [MEDIUM] HTTP Request Smuggling: LF vs CRLF handling in Waitress
HTTP Request Smuggling: LF vs CRLF handling in Waitress
### Impact
Waitress implemented a "MAY" part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:
Although the line terminator for the start-line and header fields is
the sequence CRLF, a recipient MAY recognize a single LF as a line
terminator and ignore any preceding CR.
Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.
Example:
```
Content-Length: 100[CRLF]
X-Header: x
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [fedora-all]
bugzilla·2020-01-15·CVSS 7.1
CVE-2019-16785 [HIGH] CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [fedora-all]
CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [epel-all]
bugzilla·2020-01-15·CVSS 7.1
CVE-2019-16785 [HIGH] CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [epel-all]
CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
Bugzilla
CVE-2019-16785 waitress: HTTP request smuggling through LF vs CRLF handling
bugzilla·2020-01-15·CVSS 7.1
CVE-2019-16785 [HIGH] CVE-2019-16785 waitress: HTTP request smuggling through LF vs CRLF handling
CVE-2019-16785 waitress: HTTP request smuggling through LF vs CRLF handling
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
References:
https://github.com/P
Bugzilla
CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [openstack-rdo]
bugzilla·2020-01-15·CVSS 7.1
CVE-2019-16785 [HIGH] CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [openstack-rdo]
CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
RDO T
https://access.redhat.com/errata/RHSA-2020:0720https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixeshttps://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0ebahttps://github.com/Pylons/waitress/security/advisories/GHSA-pg36-wpm5-g57phttps://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://access.redhat.com/errata/RHSA-2020:0720https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixeshttps://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0ebahttps://github.com/Pylons/waitress/security/advisories/GHSA-pg36-wpm5-g57phttps://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/https://www.oracle.com/security-alerts/cpuapr2022.html
2019-12-20
Published