Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
2019-12-20T23:15:11.167
2024-11-21T04:31:11.193
Modified
CVSSv3.1: 7.1 (HIGH)
AV:N/AC:L/Au:N/C:N/I:P/A:N
10.0
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | agendaless | waitress | ≤ 1.3.1 | Yes |
| Application | oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | Yes |
| Operating System | debian | debian_linux | 9.0 | Yes |
| Operating System | fedoraproject | fedora | 30 | Yes |
| Operating System | fedoraproject | fedora | 31 | Yes |
| Application | redhat | openstack | 15 | Yes |