CVE-2019-16785 HTTP Request Smuggling: LF vs CRLF handling in Waitress
Attackers can exploit HTTP request smuggling via LF/CRLF parsing discrepancies in Waitress, potentially bypassing security controls or accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16785?
CVE-2019-16785 is a high-severity vulnerability in Debian Debian Linux, published on 20 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
Weakness: CWE-444
Which versions are affected by CVE-2019-16785?
3 open source packages ship an affected version, including waitress. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
Products include Agendaless Waitress, Debian Debian Linux, Fedoraproject Fedora, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Redhat Openstack.
How do I fix CVE-2019-16785?
Upgrade waitress to 1.4.0 or later.
Is CVE-2019-16785 being exploited?
There is no known exploitation of CVE-2019-16785 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request
- CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion
- CVE-2022-24761 HTTP Request Smuggling in waitress
- CVE-2019-16792 HTTP Request Smuggling: Content-Length Sent Twice in Waitress
- CVE-2019-16789 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
Sources
Also known as DEBIAN-CVE-2019-16785, GHSA-pg36-wpm5-g57p, PYSEC-2019-136, UBUNTU-CVE-2019-16785.