CVE-2019-16792GHSA-4PPP-GPCR-7QF6GHSA-J7J6-7HFX-5522PYSEC-2020-178
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.4.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Timeline
- CVE published
- Record last updated
Affected versions
- Pylons Waitress
through 1.3.1
- waitressPyPI
fixed in 1.4.0
- waitressPyPI
fixed in 1.4.0