CVE-2024-49769: Waitress has a denial of service leading to high CPU usage/resource exhaustion
Impact
When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.
A remote attacker could run waitress out of available sockets with very little resources required.
Patches
Waitress 3.0.1 contains fixes that remove the race condition.
Workarounds
No work-around.
References
- https://github.com/Pylons/waitress/issues/418 - https://github.com/Pylons/waitress/pull/435
Other sources
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49769?
CVE-2024-49769 has been classified as a moderate severity vulnerability due to potential denial of service risks.
How do I fix CVE-2024-49769?
To fix CVE-2024-49769, users should upgrade their Waitress package to version 1.4.4-1.1+deb11u2 or later from Debian, or version 3.0.2 or later from pip.
Which versions of Waitress are affected by CVE-2024-49769?
CVE-2024-49769 affects Waitress versions up to and including 1.4.4-1.1+deb11u1 for Debian and versions prior to 3.0.2 for pip.
Is CVE-2024-49769 remotely exploitable?
Yes, CVE-2024-49769 can be exploited remotely due to its nature involving client-server communications.
What type of vulnerability is CVE-2024-49769?
CVE-2024-49769 is classified as a resource management vulnerability that can lead to improper handling of socket connections.