CVE-2019-16786 HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Waitress mishandles Transfer-Encoding headers, allowing HTTP request smuggling that can bypass security controls or poison caches.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16786?
CVE-2019-16786 is a high-severity vulnerability in Debian Debian Linux, published on 20 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Weakness: CWE-444
Which versions are affected by CVE-2019-16786?
3 open source packages ship an affected version, including waitress. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
waitress PyPI | All versions | 1.3.1 |
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
Products include Agendaless Waitress, Debian Debian Linux, Fedoraproject Fedora, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Redhat Openstack.
How do I fix CVE-2019-16786?
Upgrade waitress to a fixed version for your release line: 1.3.1 or 1.4.0.
Is CVE-2019-16786 being exploited?
There is no known exploitation of CVE-2019-16786 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request
- CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion
- CVE-2022-24761 HTTP Request Smuggling in waitress
- CVE-2019-16792 HTTP Request Smuggling: Content-Length Sent Twice in Waitress
- CVE-2019-16789 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
Sources
Also known as DEBIAN-CVE-2019-16786, GHSA-g2xc-35jw-c63p, PYSEC-2019-137, UBUNTU-CVE-2019-16786.