Skip to content
OpenAdvisories
Critical RHSA-2024:10145 2 CVEs

Red Hat Security Advisory: OpenShift Container Platform 4.15.39 packages and security update

Published Nov 26, 2024 · Updated Jul 3, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Openshift Ironic 4 openshift_ironic:4.15::el9 python-waitress 0:3.0.1-1.el9
Red Hat · Openshift Ironic 4 openshift_ironic:4.15::el9 python3-waitress 0:3.0.1-1.el9

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-49768

    Waitress has request processing race condition in HTTP pipelining with invalid first request

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we…

    Pylons Waitress waitress waitress Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2024-49769

    Waitress has a denial of service leading to high CPU usage/resource exhaustion

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempti…

    Pylons Waitress waitress waitress Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2322460
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2322461
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10145.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-49768
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-49768
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-49768
  • article
    https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65
  • article
    https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
  • report
    https://access.redhat.com/security/cve/CVE-2024-49769
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-49769
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-49769
  • article
    https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c
  • article
    https://github.com/Pylons/waitress/issues/418
  • article
    https://github.com/Pylons/waitress/pull/435
  • article
    https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6