CVE-2020-5236
CVE-2020-5236 · Catastrophic backtracking in regex allows Denial of Service in Waitress
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
CVSS 5.7 · Moyenne · EPSS 2,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
waitress
- Versions du logiciel
- = 1.4.2: Concernée
Aucun correctif publié
waitress PyPI
- Versions du logiciel
- 1.4.2
- Plages de versions concernées
- ECOSYSTEM: ≥ 1.4.2, < 1.4.3
Mettez à jour vers 1.4.3
waitress PyPI
- Versions du logiciel
- 0.1
- 0.2
- 0.3
- 0.4
- 0.5
- 0.6
- 0.6.1
- 0.7
- 0.8
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 0.8.5
- 0.8.6
- 0.8.7
- 0.8.8
- 0.8.9
- 0.8.10
- 0.8.11b0
- 0.9.0b0
- 0.9.0b1
- 0.9.0
- 1.0a1
- 1.0a2
- 1.0.0
- 1.0.1
- 1.0.2
- 1.1.0
- 1.2.0b1
- 1.2.0b2
- 1.2.0b3
- 1.2.0
- 1.2.1
- 1.3.0b0
- 1.3.0
- 1.3.1
- 1.4.0
- 1.4.1
- 1.4.2
- Plages de versions concernées
- GIT: < 6e46f9e3f014d64dd7d1e258eaf626e39870ee1f
- ECOSYSTEM: < 1.4.3
Mettez à jour vers 1.4.3