Medium severity · published May 31, 2022
CVE-2022-31015
Waitress is a Web Server Gateway Interface server for Python 2 and 3
5.9
CVSS
1.5%
EPSS
No
On KEV
Description
Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Waitress · Agendaless
2.1.0 before 2.1.2 · source: NVD
Affected product
WA
Waitress
Agendaless
More from Waitress
8.2
CVE-2019-16789
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed…
7.5
CVE-2024-49769
Waitress is a Web Server Gateway Interface server for Python 2 and 3
7.5
CVE-2022-24761
Waitress is a Web Server Gateway Interface server for Python 2 and 3
7.5
CVE-2019-16792
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice
7.5
CVE-2019-16786
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the…