5.9
CVSSv3

CVE-2022-31015

Published: 31/05/2022 Updated: 14/06/2022
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

agendaless waitress

Vendor Advisories

Debian Bug report logs - #1012315 waitress: CVE-2022-31015 Package: src:waitress; Maintainer for src:waitress is Debian Python Team <team+python@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 3 Jun 2022 19:21:02 UTC Severity: important Tags: security, upstream Found in version ...
Waitress is a Web Server Gateway Interface server for Python 2 and 3 Waitress versions 210 and 211 may terminate early due to a thread closing a socket while the main thread is about to call select() This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed This issue has ...