CVE-2019-16789 — HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

Description

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

Affected products

Vendor	Product	Affected	Fixed
Pylons	Waitress	< 1.4.1 – < 1.4.1	1.4.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	waitress	1.4.1-1	—
Debian 13	waitress	1.4.1-1	—
Debian 12	waitress	1.4.1-1	—
Debian 9	waitress	1.0.1-1+deb9u1	DLA-3000-1
Debian 8	waitress	0.8.9-2+deb8u1	DLA-2056-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	waitress	No fix yet	—
Ubuntu 16.04 LTS	waitress	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenStack 15	python-waitress +1	1.4.2-1.el8ost	RHSA-2020:0720

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP2	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SLES 15 SP1	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SLES 15	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SLE HPC 15	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SUSE OpenStack Cloud Crowbar 9	crowbar-core	6.0+git.1594619891.b75a61d0d-3.25.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	crowbar-openstack	6.0+git.1591795073.49cb6400e-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	grafana	6.2.5-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	kibana	4.6.3-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-barbican	7.0.1~dev24-3.9.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-ceilometer	11.1.1~dev7-3.16.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-cinder	13.0.10~dev12-3.22.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-dashboard	14.1.1~dev6-3.15.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-designate	7.0.2~dev2-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-ironic	11.1.5~dev6-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-keystone	14.2.1~dev4-3.22.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-magnum	7.2.1~dev1-3.13.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-manila	7.4.2~dev31-4.24.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-monasca-agent	2.8.2~dev5-3.9.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-neutron	13.0.8~dev68-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-neutron-vsphere	2.0.1~dev167-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-nova	18.3.1~dev38-3.25.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-octavia	3.2.3~dev7-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-octavia-amphora-image	0.1.4-7.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-resource-agents	1.0+git.1569436425.8b9c49f-5.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-Django1	1.11.29-3.15.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-Pillow	5.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-heatclient	1.16.3-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-neutron-tempest-plugin +1	0.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-os-brick	2.5.10-3.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-oslo.messaging	8.1.4-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-pyroute2	0.5.2-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-urllib3	1.23-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	release-notes-suse-openstack-cloud	9.20200610-3.21.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	rubygem-activeresource	4.0.0-4.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	rubygem-json-1_7	1.7.7-4.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	rubygem-puma	2.16.0-4.9.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	crowbar-core	5.0+git.1593156248.55bbdb26d-3.41.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	crowbar-openstack	5.0+git.1593085772.64c4ab43c-4.40.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	documentation-suse-openstack-cloud-deployment +3	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-activeresource	4.0.0-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-crowbar-client	3.9.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-json-1_7	1.7.7-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-puma	2.16.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 9	ansible1	1.9.6-9.7.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-ansible	9.0+git.1591138508.e269bdb-3.22.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-cobbler	9.0+git.1588181228.bae3b1f-3.13.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-glance	9.0+git.1593631708.9354a78-3.13.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-input-model	9.0+git.1589740948.c24fc0b-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-logging	9.0+git.1591193994.d93b668-3.13.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-manila	9.0+git.1594158642.b5905e4-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-monasca	9.0+git.1589385256.7fbfaaf-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-mq	9.0+git.1593618110.cbd1a37-3.16.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-neutron	9.0+git.1590756257.e09d54f-3.22.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-octavia	9.0+git.1590079609.a2ae6ab-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-tempest	9.0+git.1593033709.9495bb2-3.16.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	grafana	6.2.5-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	kibana	4.6.3-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-barbican	7.0.1~dev24-3.9.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-ceilometer	11.1.1~dev7-3.16.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-cinder	13.0.10~dev12-3.22.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-dashboard	14.1.1~dev6-3.15.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-designate	7.0.2~dev2-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-ironic	11.1.5~dev6-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-keystone	14.2.1~dev4-3.22.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-magnum	7.2.1~dev1-3.13.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-manila	7.4.2~dev31-4.24.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-monasca-agent	2.8.2~dev5-3.9.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-neutron	13.0.8~dev68-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-neutron-vsphere	2.0.1~dev167-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-nova	18.3.1~dev38-3.25.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-octavia	3.2.3~dev7-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-octavia-amphora-image	0.1.4-7.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-resource-agents	1.0+git.1569436425.8b9c49f-5.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-Django1	1.11.29-3.15.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-Pillow	5.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-ardana-packager	0.0.3-9.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-heatclient	1.16.3-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-neutron-tempest-plugin +1	0.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-os-brick	2.5.10-3.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-oslo.messaging	8.1.4-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-pyroute2	0.5.2-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-urllib3	1.23-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	release-notes-suse-openstack-cloud	9.20200610-3.21.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-barbican	7.0.1~dev24-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-cinder	13.0.10~dev12-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-designate	7.0.2~dev2-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-glance	17.0.1~dev30-3.17.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-heat	11.0.3~dev35-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-horizon	14.1.1~dev6-4.18.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-ironic	11.1.5~dev6-4.15.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-keystone	14.2.1~dev4-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-magnum	7.2.1~dev1-4.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-manila	7.4.2~dev31-3.21.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-monasca	2.7.1~dev10-3.17.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-monasca-ceilometer	1.8.2~dev3-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-neutron	13.0.8~dev68-6.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-nova	18.3.1~dev38-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-octavia	3.2.3~dev7-4.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-sahara	9.0.2~dev15-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-swift	2.19.2~dev48-2.14.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ansible1	1.9.6-7.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-ansible	8.0+git.1589740980.6c3bcdc-3.73.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-cluster	8.0+git.1585685203.3e71e49-3.36.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-freezer	8.0+git.1586539529.b7d295f-3.21.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-input-model	8.0+git.1589740934.0e0ad61-3.39.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-logging	8.0+git.1591194866.b7375d0-3.24.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-mq	8.0+git.1589715269.62ad6df-3.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-neutron	8.0+git.1590756744.ba84abc-3.42.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-octavia	8.0+git.1590100427.cf4cc8f-3.29.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-osconfig	8.0+git.1587034587.eac37b8-3.45.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	documentation-suse-openstack-cloud-user +8	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-GitPython	2.1.8-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-aodh	5.1.1~dev7-12.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-barbican	5.0.2~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-ceilometer	9.0.8~dev7-12.24.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-cinder	11.2.3~dev23-14.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-designate	5.0.3~dev7-12.25.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-glance	15.0.3~dev3-12.25.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-heat	9.0.8~dev22-12.27.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-horizon	12.0.5~dev3-14.30.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-ironic	9.1.8~dev8-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-keystone	12.0.4~dev11-11.28.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-manila	5.1.1~dev5-12.31.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-monasca	2.2.2~dev1-11.22.3	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.22.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-murano	4.0.2~dev2-12.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-neutron	11.0.9~dev65-13.30.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-nova	16.1.9~dev61-11.28.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-octavia	1.0.6~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-sahara	7.0.5~dev4-11.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-trove	8.0.2~dev2-11.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 7	ansible	2.2.3.0-12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-core	4.0+git.1580209654.1d112d31f-9.66.5	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-ha	4.0+git.1585316203.d6ad2c8-4.52.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-openstack	4.0+git.1589804581.9972163f0-9.71.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	grafana	4.6.5-1.14.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	keepalived	2.0.19-1.8.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	kibana	4.6.3-5.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	memcached	1.5.17-3.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	monasca-installer	20180608_12.47-12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-dashboard-theme-SUSE	2016.2-5.12.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila	3.0.1~dev30-4.12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila-doc	3.0.1~dev30-4.12.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas	9.0.2~dev5-4.9.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas-doc	9.0.2~dev5-4.9.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-nova +1	14.0.11~dev13-4.40.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-tempest	12.2.1~a0~dev177-4.9.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Django	1.8.19-3.23.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Pillow	2.8.1-4.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psql2mysql	0.5.0+git.1589351878.4ef877c-1.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psutil	1.2.1-21.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-py	1.8.1-11.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-pysaml2	4.0.2-3.17.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rabbitmq-server	3.4.4-3.16.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	release-notes-suse-openstack-cloud	7.20180803-3.18.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-activeresource	4.0.0-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-crowbar-client	3.9.2-7.20.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-json-1_7	1.7.7-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-puma	2.16.0-4.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	zookeeper	3.4.10-6.1	SUSE-RU-2020:2072-1
SUSE HPE Helion OpenStack 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ansible1	1.9.6-7.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-ansible	8.0+git.1589740980.6c3bcdc-3.73.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-cluster	8.0+git.1585685203.3e71e49-3.36.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-freezer	8.0+git.1586539529.b7d295f-3.21.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-input-model	8.0+git.1589740934.0e0ad61-3.39.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-logging	8.0+git.1591194866.b7375d0-3.24.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-mq	8.0+git.1589715269.62ad6df-3.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-neutron	8.0+git.1590756744.ba84abc-3.42.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-octavia	8.0+git.1590100427.cf4cc8f-3.29.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-osconfig	8.0+git.1587034587.eac37b8-3.45.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	documentation-hpe-helion-openstack-user +5	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-dashboard-theme-HPE	8+git.1523473653.6599ec8-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-GitPython	2.1.8-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-aodh	5.1.1~dev7-12.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-barbican	5.0.2~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-ceilometer	9.0.8~dev7-12.24.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-cinder	11.2.3~dev23-14.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-designate	5.0.3~dev7-12.25.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-glance	15.0.3~dev3-12.25.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-heat	9.0.8~dev22-12.27.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-horizon-hpe	12.0.5~dev3-14.30.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-ironic	9.1.8~dev8-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-keystone	12.0.4~dev11-11.28.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-manila	5.1.1~dev5-12.31.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca	2.2.2~dev1-11.22.3	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.22.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-murano	4.0.2~dev2-12.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-neutron	11.0.9~dev65-13.30.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-nova	16.1.9~dev61-11.28.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-octavia	1.0.6~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-sahara	7.0.5~dev4-11.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-trove	8.0.2~dev2-11.26.1	SUSE-SU-2020:1901-1
SUSE Enterprise Storage 5	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3292-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.2	python-waitress	1.4.3-lp152.4.3.1	openSUSE-SU-2020:1911-1
openSUSE Leap 15.1	python-waitress	1.4.3-lp151.3.3.1	openSUSE-SU-2020:1922-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	py3-waitress	1.4.1-r0	—
Alpine v3.23	py3-waitress	1.4.1-r0	—
Alpine v3.22	py3-waitress	1.4.1-r0	—
Alpine v3.21	py3-waitress	1.4.1-r0	—
Alpine v3.20	py3-waitress	1.4.1-r0	—

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	py3-waitress	1.4.1-r0	—
Alpine v3.18	py3-waitress	1.4.1-r0	—
Alpine v3.17	py3-waitress	1.4.1-r0	—
Alpine v3.16	py3-waitress	1.4.1-r0	—
Alpine v3.15	py3-waitress	1.4.1-r0	—
Alpine v3.14	py3-waitress	1.4.1-r0	—
Alpine v3.13	py3-waitress	1.4.1-r0	—
Alpine v3.12	py3-waitress	1.4.1-r0	—
Alpine v3.11	py3-waitress	1.4.1-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	waitress	< 1.4.2	1.4.2	GHSA-968f-66r5-5v74
PyPI	waitress	< 1.4.1	1.4.1	PYSEC-2019-138

Advisories 10

RHSA-2020:0720 Red Hat Security Advisory: python-waitress security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
DLA-2056-1 waitress - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3000-1 waitress - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2020:3292-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3269-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2020:2161-1 Security update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, o SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1922-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1911-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1901-1 Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-im SUSE / openSUSE Security Updates · Feb 4, 2026

References

FEDORA-2020-bdcc8ffc24 vendor-advisory
FEDORA-2020-65a7744e38 vendor-advisory
RHSA-2020:0720 vendor-advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes
https://github.com/github/advisory-review/pull/14604
https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017
[debian-lts-announce] 20220512 [SECURITY] [DLA 3000-1] waitress security update mailing-list

CNA	v3.1	7.1
EUVD	v3.1	7.1
OSV:GHSA	v3.1	7.1