Headline
GHSA-f5x9-8jwc-25rw: Uncaught Exception (due to a data race) leads to process termination in Waitress
Impact
Waitress may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed.
Patches
This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket, instead it is always delegated to the main thread.
Workarounds
There is no work-around, however users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: [email protected] (if security related)
Uncaught Exception (due to a data race) leads to process termination in Waitress
Moderate severity GitHub Reviewed Published Jun 2, 2022 in Pylons/waitress • Updated Jun 2, 2022
Package
pip waitress (pip )
Affected versions
>= 2.1.0, < 2.1.2
Patched versions
2.1.2
Description
Impact
Waitress may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed.
Patches
This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket, instead it is always delegated to the main thread.
Workarounds
There is no work-around, however users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: [email protected] (if security related)
References
- GHSA-f5x9-8jwc-25rw
- https://nvd.nist.gov/vuln/detail/CVE-2022-31015
- Pylons/waitress#374
- Pylons/waitress#377
- Pylons/waitress@4f6789b
bertjwregeer published the maintainer security advisory
May 30, 2022
Severity
Moderate
6.5
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248 CWE-362
CVE ID
CVE-2022-31015
GHSA ID
GHSA-f5x9-8jwc-25rw
Source code
Pylons/waitress
Credits
- oakkitten
See something to contribute? Suggest improvements for this vulnerability.
Related news
Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.