CVE-2019-16789: HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
(updated )
The patches introduced to fix https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 were not complete and still would allow an attacker to smuggle requests/split a HTTP request with invalid data.
This updates the existing CVE with ID: CVE-2019-16789
References
- access.redhat.com/errata/RHSA-2020:0720
- docs.pylonsproject.org/projects/waitress/en/latest/
- github.com/Pylons/waitress
- github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017
- github.com/Pylons/waitress/commit/ddb65b489d01d696afa1695b75fdd5df3e4ffdf8
- github.com/Pylons/waitress/security/advisories/GHSA-968f-66r5-5v74
- github.com/advisories/GHSA-968f-66r5-5v74
- github.com/github/advisory-review/pull/14604
- github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2019-138.yaml
- lists.debian.org/debian-lts-announce/2022/05/msg00011.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5
- nvd.nist.gov/vuln/detail/CVE-2019-16789
- www.oracle.com/security-alerts/cpuapr2022.html
Code Behaviors & Features
Detect and mitigate CVE-2019-16789 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →