Skip to content
OpenAdvisories

Package · Alpine

py3-waitress

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2019-16789

    HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

    In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16785

    HTTP Request Smuggling: LF vs CRLF handling in Waitress

    Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding C…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16786

    HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

    Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding sh…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI