Skip to content
OpenAdvisories
High RHSA-2020:0720 3 CVEs

Red Hat Security Advisory: python-waitress security update

Published Sep 14, 2024 · Updated Jul 3, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 15 openstack:15::el8 python-waitress 0:1.4.2-1.el8ost
Red Hat · OpenStack 15 openstack:15::el8 python3-waitress 0:1.4.2-1.el8ost

Vulnerabilities 3

  • High 7.1
    CVE-2019-16785

    HTTP Request Smuggling: LF vs CRLF handling in Waitress

    Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding C…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16786

    HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

    Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding sh…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16789

    HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

    In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1789807
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1791415
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1791420
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0720.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-16785
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16785
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16785
  • article
    https://docs.pylonsproject.org/projects/waitress/en/latest/#id6
  • report
    https://access.redhat.com/security/cve/CVE-2019-16786
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16786
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16786
  • report
    https://access.redhat.com/security/cve/CVE-2019-16789
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16789
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16789
  • article
    https://docs.pylonsproject.org/projects/waitress/en/latest/#id2