GHSA-4ppp-gpcr-7qf6

Source

https://github.com/advisories/GHSA-4ppp-gpcr-7qf6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-4ppp-gpcr-7qf6/GHSA-4ppp-gpcr-7qf6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4ppp-gpcr-7qf6

Aliases

Published

2019-12-20T23:04:35Z

Modified

2024-12-06T05:39:54.628454Z

Summary

HTTP Request Smuggling: Content-Length Sent Twice in Waitress

Details

Impact

Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally.

So a request with:

Content-Length: 10
Content-Length: 10

would get transformed to:

Content-Length: 10, 10

Which would Waitress would then internally set to Content-Lenght: 0.

Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.

Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies.

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.

Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).

Issues/more security issues:

open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-444"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2019-12-20T23:02:03Z"
}

References

Affected packages

PyPI / waitress

Package

Name: waitress; View open source insights on deps.dev
Purl: pkg:pypi/waitress

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.0

Affected versions

0.*

0.1

0.2

0.3

0.4

0.5

0.6

0.6.1

0.7

0.8

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

0.8.10

0.8.11b0

0.9.0b0

0.9.0b1

0.9.0

1.*

1.0a1

1.0a2

1.0.0

1.0.1

1.0.2

1.1.0

1.2.0b1

1.2.0b2

1.2.0b3

1.2.0

1.2.1

1.3.0b0

1.3.0

1.3.1

Ecosystem specific

{
    "affected_functions": [
        "waitress.parser.HTTPRequestParser.parse_header"
    ]
}