CVE-2019-16792
published 2020-01-22CVE-2019-16792: Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
2.12%
79.8th percentile
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| agendaless | waitress | <= 1.3.1 | — |
| debian | debian_linux | — | — |
| debian | waitress | < waitress 1.4.1-1 (bookworm) | waitress 1.4.1-1 (bookworm) |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | — | — |
| pylons | waitress | <= 1.3.1 | — |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.1-1 | 1.4.1-1 |
| pylons | waitress | >= 0 < 1.4.0 | 1.4.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress
osv·2022-05-24
CVE-2019-16792 [HIGH] Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress
Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4ppp-gpcr-7qf6. This link is maintained to preserve external references.
## Original Description
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
OSV
CVE-2019-16792: Waitress through version 1
osv·2020-01-22·CVSS 7.5
CVE-2019-16792 [HIGH] CVE-2019-16792: Waitress through version 1
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
GHSA
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
ghsa·2019-12-20
CVE-2019-16792 [CRITICAL] CWE-444 HTTP Request Smuggling: Content-Length Sent Twice in Waitress
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
### Impact
Waitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.
So a request with:
```
Content-Length: 10
Content-Length: 10
```
would get transformed to:
```
Content-Length: 10, 10
```
Which would Waitress would then internally set to `Content-Lenght: 0`.
Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.
### Patches
This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformis
OSV
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
osv·2019-12-20
CVE-2019-16792 [CRITICAL] HTTP Request Smuggling: Content-Length Sent Twice in Waitress
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
### Impact
Waitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.
So a request with:
```
Content-Length: 10
Content-Length: 10
```
would get transformed to:
```
Content-Length: 10, 10
```
Which would Waitress would then internally set to `Content-Lenght: 0`.
Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.
### Patches
This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformis
Debian
CVE-2019-16792: waitress - Waitress through version 1.3.1 allows request smuggling by sending the Content-L...
vendor_debian·2019·CVSS 7.1
CVE-2019-16792 [HIGH] CVE-2019-16792: waitress - Waitress through version 1.3.1 allows request smuggling by sending the Content-L...
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Scope: local
bookworm: resolved (fixed in 1.4.1-1)
bullseye: resolved (fixed in 1.4.1-1)
forky: resolved (fixed in 1.4.1-1)
sid: resolved (fixed in 1.4.1-1)
trixie: resolved (fixed in 1.4.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixeshttps://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixeshttps://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.html
2020-01-22
Published