USN-7115-1: Waitress vulnerabilities
It was discovered that Waitress could process follow up requests when receiving a specially crafted message. An attacker could use this issue to have the server process inconsistent client requests. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-49768) Dylan Jay discovered that Waitress could be lead to write to an unexisting socket after closing the remote connection. An attacker could use this issue to increase resource utilization leading to a denial of service. (CVE-2024-49769)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7115-1?
The severity of USN-7115-1 has not been explicitly stated, but it is related to a vulnerability in the Python Waitress package that can lead to inconsistent request processing.
How do I fix USN-7115-1?
To fix USN-7115-1, you should update your python3-waitress package to the fixed version available for your Ubuntu release.
Which Ubuntu versions are affected by USN-7115-1?
USN-7115-1 affects Ubuntu versions 24.04 LTS, 24.10, 22.04, and 20.04.
What is the cause of the vulnerability described in USN-7115-1?
The vulnerability in USN-7115-1 is caused by Waitress's ability to process follow-up requests from specially crafted messages.
Is there a known exploit for USN-7115-1?
There is currently no public knowledge of a specific exploit for USN-7115-1, but the described issue allows attackers to cause server inconsistencies.