CVE-2022-31015

published 2022-05-31

CVE-2022-31015: Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket…

Priority P4 28 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C N I N A H

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
agendaless	waitress	>= 2.1.0 < 2.1.2	2.1.2
debian	waitress	< waitress 2.1.2-1 (bookworm)	waitress 2.1.2-1 (bookworm)
msrc	azl3_python-waitress_3.0.1-1_on_azure_linux_3.0	—	—
pylons	waitress	—	—
pylons	waitress	>= 0 < 2.1.2-1	2.1.2-1
pylons	waitress	>= 0 < 2.1.2-1	2.1.2-1
pylons	waitress	>= 0 < 2.1.2-1	2.1.2-1
pylons	waitress	>= 2.1.0 < 2.1.2	2.1.2

CVSS provenance

nvd v3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:N/A:P

osv 5.9 MEDIUM

vendor_debian 6.5 MEDIUM

vendor_msrc 6.5 MEDIUM

vendor_redhat 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-248 CWE-362