CVE-2019-16792
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Waitress hasta la versión 1.3.1, permite el tráfico no autorizado de peticiones mediante el envío del encabezado Content-Length dos veces. Waitress doblará un encabezado Content-Length doble y, al no ser capaz de convertir el valor ahora separado por comas en un entero, establecerá a Content-Length en 0 internamente. Si dos encabezados Content-Length se envían en una sola petición, Waitress trataría la petición como si no tiene cuerpo, por lo que tratará el cuerpo de la petición como una nueva petición en HTTP pipelining. Este problema es corregido en Waitress versión 1.4.0.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-09-24 CVE Reserved
- 2020-01-22 CVE Published
- 2024-05-17 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes | Release Notes | |
https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6 | Third Party Advisory | |
https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65 | 2022-09-23 | |
https://www.oracle.com/security-alerts/cpuapr2022.html | 2022-09-23 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Agendaless Search vendor "Agendaless" | Waitress Search vendor "Agendaless" for product "Waitress" | <= 1.3.1 Search vendor "Agendaless" for product "Waitress" and version " <= 1.3.1" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Cloud Native Core Network Function Cloud Native Environment Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" | 1.10.0 Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "1.10.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
|