CVE-2019-16789
published 2019-12-26CVE-2019-16789: In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end…
PriorityP346high8.2CVSS 3.1
AVNACLPRNUINSUCLIHAN
EPSS
2.59%
83.5th percentile
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| agendaless | waitress | <= 1.4.0 | — |
| debian | debian_linux | — | — |
| debian | waitress | < waitress 1.4.1-1 (bookworm) | waitress 1.4.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | — | — |
| pylons | waitress | < 1.4.1 | 1.4.1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.2 | 1.4.2 |
| redhat | openstack | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
ghsa8.2HIGH
osv8.2HIGH
vendor_oracle8.2HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
osv·2020-01-06·CVSS 8.2
CVE-2019-16789 [HIGH] HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
### Impact
The patches introduced to fix https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 were not complete and still would allow an attacker to smuggle requests/split a HTTP request with invalid data.
This updates the existing CVE with ID: CVE-2019-16789
### Patches
Waitress version 1.4.2 has been updated to now validate HTTP headers better to avoid the issue, completely fixing all known issues with whitespace.
### Workarounds
There are no work-arounds, upgrading to Waitress 1.4.2 is highly recommended.
### References
See https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 for more information on the security issue.
### For more information
I
GHSA
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
ghsa·2020-01-06·CVSS 8.2
CVE-2019-16789 [HIGH] CWE-444 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
### Impact
The patches introduced to fix https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 were not complete and still would allow an attacker to smuggle requests/split a HTTP request with invalid data.
This updates the existing CVE with ID: CVE-2019-16789
### Patches
Waitress version 1.4.2 has been updated to now validate HTTP headers better to avoid the issue, completely fixing all known issues with whitespace.
### Workarounds
There are no work-arounds, upgrading to Waitress 1.4.2 is highly recommended.
### References
See https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 for more information on the security issue.
### For more information
I
OSV
CVE-2019-16789: In Waitress through version 1
osv·2019-12-26·CVSS 8.2
CVE-2019-16789 [HIGH] CVE-2019-16789: In Waitress through version 1
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through mor
Oracle
Oracle Oracle Communications Risk Matrix: OC-CNE (ceph) — CVE-2019-16789
vendor_oracle·2022-04-15·CVSS 8.2
CVE-2019-16789 [HIGH] Oracle Oracle Communications Risk Matrix: OC-CNE (ceph) — CVE-2019-16789
Oracle Oracle Communications Risk Matrix: OC-CNE (ceph) vulnerability
CVE: CVE-2019-16789
CVSS: 8.2
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
vendor_redhat·2019-12-26·CVSS 7.1
CVE-2019-16789 [HIGH] CWE-444 waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or u
Debian
CVE-2019-16789: waitress - In Waitress through version 1.4.0, if a proxy server is used in front of waitres...
vendor_debian·2019·CVSS 7.1
CVE-2019-16789 [HIGH] CVE-2019-16789: waitress - In Waitress through version 1.4.0, if a proxy server is used in front of waitres...
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through mor
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [openstack-rdo]
bugzilla·2020-01-14·CVSS 7.1
CVE-2019-16789 [HIGH] CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [openstack-rdo]
CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message
Bugzilla
CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [fedora-all]
bugzilla·2020-01-10·CVSS 7.1
CVE-2019-16789 [HIGH] CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [fedora-all]
CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOT
Bugzilla
CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [epel-all]
bugzilla·2020-01-10·CVSS 7.1
CVE-2019-16789 [HIGH] CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [epel-all]
CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: t
Bugzilla
CVE-2019-16789 waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
bugzilla·2020-01-10·CVSS 7.1
CVE-2019-16789 [HIGH] CVE-2019-16789 waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
CVE-2019-16789 waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache
https://access.redhat.com/errata/RHSA-2020:0720https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixeshttps://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017https://github.com/github/advisory-review/pull/14604https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://access.redhat.com/errata/RHSA-2020:0720https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixeshttps://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017https://github.com/github/advisory-review/pull/14604https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/https://www.oracle.com/security-alerts/cpuapr2022.html
2019-12-26
Published