Summary
It was discovered that Waitress could process follow up requests when
receiving a specially crafted message. An attacker could use this issue to
have the server process inconsistent client requests. This issue only
affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-49768)
Dylan Jay discovered that Waitress could be lead to write to an unexisting
socket after closing the remote connection. An attacker could use this
issue to increase resource utilization leading to a denial of service.
(CVE-2024-49769)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | waitress | 1.4.1-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | waitress | 1.4.4-1.1ubuntu1.1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | waitress | 2.1.2-2ubuntu0.1~esm1 |
Vulnerabilities 2
-
Critical 9.1
Waitress has request processing race condition in HTTP pipelining with invalid first request
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we…
-
High 7.5
Waitress has a denial of service leading to high CPU usage/resource exhaustion
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempti…