Medium severity · published Oct 29, 2024
CVE-2024-49768
Waitress is a Web Server Gateway Interface server for Python 2 and 3
4.8
CVSS
0.5%
EPSS
No
On KEV
Description
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Waitress · Agendaless
2.0.0 before 3.0.1 · source: NVD
Affected product
WA
Waitress
Agendaless
More from Waitress
8.2
CVE-2019-16789
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed…
7.5
CVE-2024-49769
Waitress is a Web Server Gateway Interface server for Python 2 and 3
7.5
CVE-2022-24761
Waitress is a Web Server Gateway Interface server for Python 2 and 3
7.5
CVE-2019-16792
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice
7.5
CVE-2019-16786
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the…