CVE-2024-49769: Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
(updated )
When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won’t correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.
A remote attacker could run waitress out of available sockets with very little resources required.
References
- github.com/Pylons/waitress
- github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c
- github.com/Pylons/waitress/issues/418
- github.com/Pylons/waitress/pull/435
- github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6
- github.com/advisories/GHSA-3f84-rpwh-47g6
- github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2024-211.yaml
- lists.debian.org/debian-lts-announce/2024/11/msg00012.html
- nvd.nist.gov/vuln/detail/CVE-2024-49769
Code Behaviors & Features
Detect and mitigate CVE-2024-49769 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →