openSUSE-SU-2020:1922-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2020:1922-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2020:1922-1

Related

Published

2020-11-14T17:27:37Z

Modified

2020-11-14T17:27:37Z

Summary

Security update for python-waitress

Details

This update for python-waitress to 1.4.3 fixes the following security issues:

CVE-2019-16785: HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
CVE-2019-16786: HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
CVE-2019-16789: HTTP request smuggling through invalid whitespace characters (bsc#1160790).
CVE-2019-16792: HTTP request smuggling by sending the Content-Length header twice (bsc#1161670).

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.1 / python-waitress

Package

Name: python-waitress
Purl: purl:rpm/suse/python-waitress&distro=openSUSE%20Leap%2015.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.3-lp151.3.3.1

Ecosystem specific

{
    "binaries": [
        {
            "python2-waitress": "1.4.3-lp151.3.3.1",
            "python3-waitress": "1.4.3-lp151.3.3.1"
        }
    ]
}