admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-08-04 08:44:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-merge PR#2969

Browse Source 
Auto-merge PR#2969
This commit is contained in:
CVE Team 2019-12-26 11:40:17 -05:00 committed by GitHub
commit 618d18c7b2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 101 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
2019/16xxx/CVE-2019-16789.json Normal file
View File

@ -0,0 +1,101 @@
{
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2019-16789",
"STATE": "PUBLIC",
"TITLE": "HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Waitress",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "< 1.4.1",
"version_value": "1.4.1"
}
]
}
}
]
},
"vendor_name": "Pylons"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling.\n\nSpecially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters.\n\nIf a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure.\n\nThis issue is fixed in Waitress 1.4.1 through more strict HTTP field validation."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/github/advisory-review/pull/14604",
"refsource": "CONFIRM",
"url": "https://github.com/github/advisory-review/pull/14604"
},
{
"name": "https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017",
"refsource": "MISC",
"url": "https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017"
},
{
"name": "https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes",
"refsource": "MISC",
"url": "https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes"
}
]
},
"source": {
"advisory": "GHSA-m5ff-3wj3-8ph4",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "eng",
"value": "You may enable additional protections on front-end servers, those that follow RFC7230 correctly would drop the request with a 400 Bad Request.\n\nWaitress will now correctly responds to the request with a 400 Bad Request, and will drop the connection to avoid any potential HTTP pipelining issues."
}
]
}