CVE-2022-31015 Uncaught Exception (due to a data race) leads to process termination in Waitress
A race condition in Waitress allows a thread to close a socket during select, causing an unhandled exception and terminating the server process.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31015?
CVE-2022-31015 is a medium-severity vulnerability in Pylons waitress, published on 31 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
Which versions are affected by CVE-2022-31015?
3 open source packages ship an affected version, including waitress. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
waitress PyPI | From 2.1.0 | 2.1.2 |
waitress PyPI | From 2.1.0 | 2.1.2 |
waitress PyPI | From 2.1.0 | 2.1.2 |
Products include Agendaless Waitress.
How do I fix CVE-2022-31015?
Upgrade waitress to 2.1.2 or later.
Is CVE-2022-31015 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31015 exists.
Other vulnerabilities in Pylons waitress
- CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request
- CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion
- CVE-2022-24761 HTTP Request Smuggling in waitress
- CVE-2019-16792 HTTP Request Smuggling: Content-Length Sent Twice in Waitress
- CVE-2019-16789 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
Sources
Also known as AZL-43513, AZL-44571, DEBIAN-CVE-2022-31015, GHSA-f5x9-8jwc-25rw, PYSEC-2022-205, openSUSE-SU-2024:12346-1.