MGASA-2020-0083 - Updated python-waitress packages fix security vulnerabilities

Publication date: 13 Feb 2020
URL: https://advisories.mageia.org/MGASA-2020-0083.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-16785,
     CVE-2019-16786,
     CVE-2019-16789

Updated python-waitress packages fix security vulnerabilities:

If a front-end server does not parse header fields with an LF the same
way as it does those with a CRLF it can lead to the front-end and the
back-end server parsing the same HTTP message in two different ways.
This can lead to a potential for HTTP request smuggling/splitting whereby
Waitress may see two requests while the front-end server only sees a
single HTTP message (CVE-2019-16785).

Waitress through version 1.3.1 would parse the Transfer-Encoding header
and only look for a single string value, if that value was not chunked
it would fall through and use the Content-Length header instead. This
could allow for Waitress to treat a single request as multiple requests
in the case of HTTP pipelining (CVE-2019-16786).

In Waitress through version 1.4.0, if a proxy server is used in front of
waitress, an invalid request may be sent by an attacker that bypasses the
front-end and is parsed differently by waitress leading to a potential for
HTTP request smuggling. If a front-end server does HTTP pipelining to a
backend Waitress server this could lead to HTTP request splitting which
may lead to potential cache poisoning or unexpected information disclosure
(CVE-2019-16789).

References:
- https://bugs.mageia.org/show_bug.cgi?id=26014
- https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16785
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16786
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16789

SRPMS:
- 7/core/python-waitress-1.4.2-1.mga7