waitress - Debian Package Tracker

general

source: waitress (main)
version: 1.4.4-1.1
maintainer: Debian Python Team (DMD)
uploaders: Andrej Shadura [DMD]
arch: all
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.1-1
oldstable: 1.2.0~b2-2
stable: 1.4.4-1.1
testing: 1.4.4-1.1
unstable: 1.4.4-1.1

versioned links

1.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.0~b2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.4-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-waitress-doc
python3-waitress

action needed

A new upstream version is available: 2.0.0b1 high

A new upstream version 2.0.0b1 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2021-12-05 08:38

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.4.4-1.2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 69aff0e10a6aab8f9bcf6d4da6579abe886d1cea
Merge: 4892163 d2e77a4
Author: Sandro Tosi <morph@debian.org>
Date:   Fri Sep 24 17:14:57 2021 +0000

    Merge branch 'scrub-obsolete' into 'master'
    
    Remove unnecessary constraints
    
    See merge request python-team/packages/waitress!2

commit d2e77a421b05e6288989dfefa8df5c68151249e5
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Sep 24 09:31:02 2021 +0000

    Remove constraints unnecessary since buster
    
    * Build-Depends: Drop versioned constraint on python3-all and python3-setuptools.
    
    Changes-By: deb-scrub-obsolete

commit 4892163d9bf4b352d90ddf4ae256ccd864589382
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Aug 26 04:02:53 2021 +0000

    Update standards version to 4.5.1, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

commit 04da8eab6b424992de4bd82b10cdd97cd0f4cfc1
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Aug 26 04:02:51 2021 +0000

    Bump debhelper from old 12 to 13.
    
    Changes-By: lintian-brush
    Fixes: lintian: package-uses-old-debhelper-compat-version
    See-also: https://lintian.debian.org/tags/package-uses-old-debhelper-compat-version.html

Created: 2021-09-02 Last update: 2021-11-29 14:38

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-10-23 Last update: 2021-11-05 04:35

4 low-priority security issues in buster low

There are 4 open security issues in buster.

4 issues left for the package maintainer to handle:

CVE-2019-16785: (needs triaging) Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
CVE-2019-16786: (needs triaging) Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
CVE-2019-16789: (needs triaging) In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
CVE-2019-16792: (needs triaging) Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-02-19 Last update: 2021-12-05 06:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.0 instead of 4.5.0).

Created: 2020-01-21 Last update: 2021-08-18 14:02

news

[rss feed]

[2021-05-22] waitress 1.4.4-1.1 MIGRATED to testing (Debian testing watch)
[2021-04-25] Accepted waitress 1.4.4-1.1 (source) into unstable (Andreas Beckmann)
[2021-01-14] waitress 1.4.4-1 MIGRATED to testing (Debian testing watch)
[2021-01-09] Accepted waitress 1.4.4-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-01-06] waitress 1.4.1-1 MIGRATED to testing (Debian testing watch)
[2020-01-01] Accepted waitress 0.8.9-2+deb8u1 (source all) into oldoldstable (Chris Lamb)
[2020-01-01] Accepted waitress 1.4.1-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-09-18] waitress 1.3.1-4 MIGRATED to testing (Debian testing watch)
[2019-09-12] Accepted waitress 1.3.1-4 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-09-12] Accepted waitress 1.3.1-3 (all source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-09-12] Accepted waitress 1.3.1-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-01-14] waitress 1.2.0~b2-2 MIGRATED to testing (Debian testing watch)
[2019-01-08] Accepted waitress 1.2.0~b2-2 (all source) into unstable (Andrej Shadura)
[2019-01-07] Accepted waitress 1.2.0~b2-1 (source) into unstable (Andrej Shadura)
[2018-05-15] waitress 1.1.0-1 MIGRATED to testing (Debian testing watch)
[2018-05-13] Accepted waitress 1.1.0-1 (source) into unstable (Andrej Shadura)
[2016-12-24] waitress 1.0.1-1 MIGRATED to testing (Debian testing watch)
[2016-12-13] Accepted waitress 1.0.1-1 (source) into unstable (Andrew Shadura)
[2016-01-01] waitress 0.8.10-1 MIGRATED to testing (Debian testing watch)
[2015-12-26] Accepted waitress 0.8.10-1 (source) into unstable (Andrew Shadura)
[2014-10-24] waitress 0.8.9-2 MIGRATED to testing (Britney)
[2014-10-13] Accepted waitress 0.8.9-2 (source all) into unstable (Andrew Shadura)
[2014-10-08] Accepted waitress 0.8.9-1 (source all) into unstable (Andrew Shadura)
[2014-05-04] waitress 0.8.8-3 MIGRATED to testing (Debian testing watch)
[2014-04-24] Accepted waitress 0.8.8-3 (source all) (Andrew Shadura)
[2014-04-24] Accepted waitress 0.8.8-2 (source all) (Andrew Shadura)
[2013-12-25] waitress 0.8.8-1 MIGRATED to testing (Debian testing watch)
[2013-12-14] Accepted waitress 0.8.8-1 (source all) (Andrew Shadura)
[2013-12-14] Accepted waitress 0.8.7-3 (source all) (Andrew Shadura)
[2013-10-14] waitress 0.8.7-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 3)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.4-1.1