CVE-2019-16792 HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Attackers can smuggle HTTP requests by sending duplicate Content-Length headers, bypassing security controls and potentially accessing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16792?
CVE-2019-16792 is a high-severity vulnerability in Debian Debian Linux, published on 22 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Weakness: CWE-444
Which versions are affected by CVE-2019-16792?
5 open source packages ship an affected version, including waitress. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
waitress PyPI | All versions | 1.4.0 |
Products include Agendaless Waitress, Debian Debian Linux, Oracle Communications Cloud Native Core Network Function Cloud Native Environment.
How do I fix CVE-2019-16792?
Upgrade waitress to 1.4.0 or later.
Is CVE-2019-16792 being exploited?
There is no known exploitation of CVE-2019-16792 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request
- CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion
- CVE-2022-24761 HTTP Request Smuggling in waitress
- CVE-2019-16789 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
- CVE-2019-16785 HTTP Request Smuggling: LF vs CRLF handling in Waitress
Sources
Also known as DEBIAN-CVE-2019-16792, GHSA-4ppp-gpcr-7qf6, GHSA-j7j6-7hfx-5522, PYSEC-2020-178, UBUNTU-CVE-2019-16792.