CVE-2019-16792 — HTTP Request Smuggling: Content-Length Sent Twice in Waitress

Description

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Affected products

Vendor	Product	Affected	Fixed
Pylons	Waitress	<= 1.3.1 – ≤ 1.3.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	waitress	1.4.1-1	—
Debian 13	waitress	1.4.1-1	—
Debian 12	waitress	1.4.1-1	—
Debian 9	waitress	1.0.1-1+deb9u1	DLA-3000-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	waitress	No fix yet	—
Ubuntu 16.04 LTS	waitress	No fix yet	—

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP2	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SLES 15 SP1	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SLES 15	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SLE HPC 15	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3269-1
SUSE OpenStack Cloud Crowbar 9	crowbar-core	6.0+git.1594619891.b75a61d0d-3.25.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	crowbar-openstack	6.0+git.1591795073.49cb6400e-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	grafana	6.2.5-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	kibana	4.6.3-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-barbican	7.0.1~dev24-3.9.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-ceilometer	11.1.1~dev7-3.16.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-cinder	13.0.10~dev12-3.22.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-dashboard	14.1.1~dev6-3.15.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-designate	7.0.2~dev2-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-ironic	11.1.5~dev6-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-keystone	14.2.1~dev4-3.22.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-magnum	7.2.1~dev1-3.13.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-manila	7.4.2~dev31-4.24.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-monasca-agent	2.8.2~dev5-3.9.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-neutron	13.0.8~dev68-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-neutron-vsphere	2.0.1~dev167-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-nova	18.3.1~dev38-3.25.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-octavia	3.2.3~dev7-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-octavia-amphora-image	0.1.4-7.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	openstack-resource-agents	1.0+git.1569436425.8b9c49f-5.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-Django1	1.11.29-3.15.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-Pillow	5.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-heatclient	1.16.3-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-neutron-tempest-plugin +1	0.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-os-brick	2.5.10-3.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-oslo.messaging	8.1.4-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-pyroute2	0.5.2-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-urllib3	1.23-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	release-notes-suse-openstack-cloud	9.20200610-3.21.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	rubygem-activeresource	4.0.0-4.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	rubygem-json-1_7	1.7.7-4.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9	rubygem-puma	2.16.0-4.9.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	crowbar-core	5.0+git.1593156248.55bbdb26d-3.41.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	crowbar-openstack	5.0+git.1593085772.64c4ab43c-4.40.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	documentation-suse-openstack-cloud-deployment +3	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-activeresource	4.0.0-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-crowbar-client	3.9.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-json-1_7	1.7.7-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-puma	2.16.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 9	ansible1	1.9.6-9.7.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-ansible	9.0+git.1591138508.e269bdb-3.22.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-cobbler	9.0+git.1588181228.bae3b1f-3.13.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-glance	9.0+git.1593631708.9354a78-3.13.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-input-model	9.0+git.1589740948.c24fc0b-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-logging	9.0+git.1591193994.d93b668-3.13.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-manila	9.0+git.1594158642.b5905e4-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-monasca	9.0+git.1589385256.7fbfaaf-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-mq	9.0+git.1593618110.cbd1a37-3.16.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-neutron	9.0+git.1590756257.e09d54f-3.22.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-octavia	9.0+git.1590079609.a2ae6ab-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	ardana-tempest	9.0+git.1593033709.9495bb2-3.16.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	grafana	6.2.5-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	kibana	4.6.3-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-barbican	7.0.1~dev24-3.9.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-ceilometer	11.1.1~dev7-3.16.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-cinder	13.0.10~dev12-3.22.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-dashboard	14.1.1~dev6-3.15.5	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-designate	7.0.2~dev2-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-ironic	11.1.5~dev6-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-keystone	14.2.1~dev4-3.22.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-magnum	7.2.1~dev1-3.13.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-manila	7.4.2~dev31-4.24.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-monasca-agent	2.8.2~dev5-3.9.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-neutron	13.0.8~dev68-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-neutron-vsphere	2.0.1~dev167-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-nova	18.3.1~dev38-3.25.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-octavia	3.2.3~dev7-3.25.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-octavia-amphora-image	0.1.4-7.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	openstack-resource-agents	1.0+git.1569436425.8b9c49f-5.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-Django1	1.11.29-3.15.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-Pillow	5.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-ardana-packager	0.0.3-9.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-heatclient	1.16.3-3.3.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-neutron-tempest-plugin +1	0.2.0-3.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-os-brick	2.5.10-3.12.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-oslo.messaging	8.1.4-3.6.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-pyroute2	0.5.2-4.3.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-urllib3	1.23-3.12.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	release-notes-suse-openstack-cloud	9.20200610-3.21.4	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-barbican	7.0.1~dev24-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-cinder	13.0.10~dev12-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-designate	7.0.2~dev2-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-glance	17.0.1~dev30-3.17.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-heat	11.0.3~dev35-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-horizon	14.1.1~dev6-4.18.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-ironic	11.1.5~dev6-4.15.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-keystone	14.2.1~dev4-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-magnum	7.2.1~dev1-4.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-manila	7.4.2~dev31-3.21.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-monasca	2.7.1~dev10-3.17.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-monasca-ceilometer	1.8.2~dev3-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-neutron	13.0.8~dev68-6.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-nova	18.3.1~dev38-3.19.3	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-octavia	3.2.3~dev7-4.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-sahara	9.0.2~dev15-3.19.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9	venv-openstack-swift	2.19.2~dev48-2.14.2	SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ansible1	1.9.6-7.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-ansible	8.0+git.1589740980.6c3bcdc-3.73.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-cluster	8.0+git.1585685203.3e71e49-3.36.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-freezer	8.0+git.1586539529.b7d295f-3.21.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-input-model	8.0+git.1589740934.0e0ad61-3.39.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-logging	8.0+git.1591194866.b7375d0-3.24.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-mq	8.0+git.1589715269.62ad6df-3.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-neutron	8.0+git.1590756744.ba84abc-3.42.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-octavia	8.0+git.1590100427.cf4cc8f-3.29.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-osconfig	8.0+git.1587034587.eac37b8-3.45.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	documentation-suse-openstack-cloud-user +8	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-GitPython	2.1.8-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-aodh	5.1.1~dev7-12.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-barbican	5.0.2~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-ceilometer	9.0.8~dev7-12.24.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-cinder	11.2.3~dev23-14.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-designate	5.0.3~dev7-12.25.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-glance	15.0.3~dev3-12.25.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-heat	9.0.8~dev22-12.27.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-horizon	12.0.5~dev3-14.30.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-ironic	9.1.8~dev8-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-keystone	12.0.4~dev11-11.28.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-manila	5.1.1~dev5-12.31.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-monasca	2.2.2~dev1-11.22.3	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.22.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-murano	4.0.2~dev2-12.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-neutron	11.0.9~dev65-13.30.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-nova	16.1.9~dev61-11.28.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-octavia	1.0.6~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-sahara	7.0.5~dev4-11.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-trove	8.0.2~dev2-11.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 7	ansible	2.2.3.0-12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-core	4.0+git.1580209654.1d112d31f-9.66.5	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-ha	4.0+git.1585316203.d6ad2c8-4.52.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-openstack	4.0+git.1589804581.9972163f0-9.71.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	grafana	4.6.5-1.14.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	keepalived	2.0.19-1.8.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	kibana	4.6.3-5.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	memcached	1.5.17-3.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	monasca-installer	20180608_12.47-12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-dashboard-theme-SUSE	2016.2-5.12.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila	3.0.1~dev30-4.12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila-doc	3.0.1~dev30-4.12.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas	9.0.2~dev5-4.9.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas-doc	9.0.2~dev5-4.9.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-nova +1	14.0.11~dev13-4.40.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-tempest	12.2.1~a0~dev177-4.9.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Django	1.8.19-3.23.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Pillow	2.8.1-4.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psql2mysql	0.5.0+git.1589351878.4ef877c-1.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psutil	1.2.1-21.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-py	1.8.1-11.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-pysaml2	4.0.2-3.17.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rabbitmq-server	3.4.4-3.16.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	release-notes-suse-openstack-cloud	7.20180803-3.18.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-activeresource	4.0.0-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-crowbar-client	3.9.2-7.20.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-json-1_7	1.7.7-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-puma	2.16.0-4.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	zookeeper	3.4.10-6.1	SUSE-RU-2020:2072-1
SUSE HPE Helion OpenStack 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ansible1	1.9.6-7.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-ansible	8.0+git.1589740980.6c3bcdc-3.73.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-cluster	8.0+git.1585685203.3e71e49-3.36.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-freezer	8.0+git.1586539529.b7d295f-3.21.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-input-model	8.0+git.1589740934.0e0ad61-3.39.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-logging	8.0+git.1591194866.b7375d0-3.24.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-mq	8.0+git.1589715269.62ad6df-3.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-neutron	8.0+git.1590756744.ba84abc-3.42.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-octavia	8.0+git.1590100427.cf4cc8f-3.29.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-osconfig	8.0+git.1587034587.eac37b8-3.45.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	documentation-hpe-helion-openstack-user +5	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-dashboard-theme-HPE	8+git.1523473653.6599ec8-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-GitPython	2.1.8-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-aodh	5.1.1~dev7-12.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-barbican	5.0.2~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-ceilometer	9.0.8~dev7-12.24.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-cinder	11.2.3~dev23-14.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-designate	5.0.3~dev7-12.25.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-glance	15.0.3~dev3-12.25.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-heat	9.0.8~dev22-12.27.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-horizon-hpe	12.0.5~dev3-14.30.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-ironic	9.1.8~dev8-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-keystone	12.0.4~dev11-11.28.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-manila	5.1.1~dev5-12.31.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca	2.2.2~dev1-11.22.3	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.22.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-murano	4.0.2~dev2-12.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-neutron	11.0.9~dev65-13.30.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-nova	16.1.9~dev61-11.28.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-octavia	1.0.6~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-sahara	7.0.5~dev4-11.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-trove	8.0.2~dev2-11.26.1	SUSE-SU-2020:1901-1
SUSE Enterprise Storage 5	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:3292-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.2	python-waitress	1.4.3-lp152.4.3.1	openSUSE-SU-2020:1911-1
openSUSE Leap 15.1	python-waitress	1.4.3-lp151.3.3.1	openSUSE-SU-2020:1922-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	waitress	< 1.4.0	1.4.0	GHSA-4ppp-gpcr-7qf6

Advisories 8

DLA-3000-1 waitress - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2020:3292-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3269-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2020:2161-1 Security update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, o SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1922-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1911-1 Security update for python-waitress SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1901-1 Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-im SUSE / openSUSE Security Updates · Feb 4, 2026

CNA	v3.1	7.1
EUVD	v3.1	7.1

HTTP Request Smuggling: Content-Length Sent Twice in Waitress

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

SUSE

openSUSE

Affected packages

Advisories 8

References