Vulnerability · Published Feb 4, 2020 · Assigned by GitHub_M
CVE-2020-5236Catastrophic backtracking in regex allows Denial of Service in Waitress
Medium 5.7
In plain English
A medium-severity uncontrolled resource consumption in Waitress from Pylons. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | waitress | 1.4.3 | GHSA-73m2-3pwg-5fgc |
| PyPI | waitress | 1.4.3 | PYSEC-2020-155 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H