HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Impact
Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally.
So a request with:
Content-Length: 10
Content-Length: 10would get transformed to:
Content-Length: 10, 10Which would Waitress would then internally set to Content-Lenght: 0.
Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.
Patches
This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies.
The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.
Workarounds
Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).
Issues/more security issues:
- open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | waitress | < 1.4.0 | 1.4.0 |
Referencias
- https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes
- https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65
- https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6
- https://github.com/advisories/GHSA-j7j6-7hfx-5522
- https://nvd.nist.gov/vuln/detail/CVE-2019-16792
- https://github.com/Pylons/waitress
- https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2020-178.yaml
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Debilidad (CWE)
CWE-444- Plataforma
- Python (PyPI)
- Paquete
waitress- Publicada
- 20.12.2019
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2020-178 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-j7j6-7hfx-5522 - CC BY 4.0
OSV / GitHub Advisory Database - GHSA-4ppp-gpcr-7qf6 - CC BY 4.0
Historial de vulnerabilidades: waitress
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 10
- Primera → última
- 12.2019 10.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 4
- Media 4
Divulgaciones por año
- 2019: 5
- 2020: 1
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 0
-
HTTP Request Smuggling: Content-Length Sent Twice in Waitress esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.