Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress

Open Source Vulnerabilities GHSA-4ppp-gpcr-7qf6

### Impact Waitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally. So a request with: ``` Content-Length: 10 Content-Length: 10 ``` would get transformed to: ``` Content-Length: 10, 10 ``` Which would Waitress would then internally set to `Content-Lenght: 0`. Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. ### Patches This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior. ### Workarounds Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method). ### Issues/more security issues: * open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related) * email the Pylons Security mailing list: [email protected] (if security related)

Open Source Vulnerabilities CVE-2019-16792

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Open Source Vulnerabilities GHSA-j7j6-7hfx-5522

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4ppp-gpcr-7qf6. This link is maintained to preserve external references. ## Original Description Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Open Source Vulnerabilities PYSEC-2020-178

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.