CVE-2019-16792

Katalog CVE

CVSS 7.5 · High EPSS 2,0%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada agendaless waitress, oracle communications cloud native core network function cloud native environment +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Rincian

Terbit di NVD

22 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65 patch
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html mailing list · advisory pihak ketiga
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes release notes