Debian Package Tracker

general

source: waitress (main)
version: 1.4.1-1
maintainer: Debian Python Modules Team (archive) (DMD)
uploaders: Andrej Shadura [DMD]
arch: all
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.8.9-2
o-o-sec: 0.8.9-2+deb8u1
oldstable: 1.0.1-1
stable: 1.2.0~b2-2
testing: 1.4.1-1
unstable: 1.4.1-1

versioned links

0.8.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.8.9-2+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.0~b2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-waitress-doc
python3-waitress

action needed

A new upstream version is available: 1.4.4 high

A new upstream version 1.4.4 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2020-10-30 14:02

lintian reports 2 errors and 6 warnings high

Lintian reports 2 errors and 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-07-29 Last update: 2020-10-22 04:34

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-07-10 Last update: 2020-10-30 14:04

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.4.1-1.1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 09ecfcc8234fc1ebc4599f8554096c51d0232970
Author: Ondřej Nový <onovy@debian.org>
Date:   Thu Sep 24 08:47:05 2020 +0200

    d/control: Update Vcs-* fields with new Debian Python Team Salsa layout

commit a1e86045b7aa013057744e9960c5d7699ac096c2
Author: Ondřej Nový <onovy@debian.org>
Date:   Thu Sep 24 08:47:04 2020 +0200

    d/control: Update Maintainer field with new Debian Python Team contact address

commit 55661fdaf8634f88988a295535cafc86d7c590f0
Merge: de3e7f9 dd0a308
Author: Jelmer Vernooĳ <jelmer@debian.org>
Date:   Thu Sep 10 16:37:09 2020 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Fix some issues reported by lintian
    
    See merge request python-team/modules/waitress!1

commit dd0a308107927be4e670ff419bdcbbbd3c3c7474
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Jul 17 19:41:42 2020 +0000

    Update standards version to 4.5.0, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

commit e79963f46baa7cadeaee6e1adc439eb03a01027c
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Jul 17 19:40:59 2020 +0000

    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse.
    
    Changes-By: lintian-brush
    Fixes: lintian: upstream-metadata-file-is-missing
    See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html
    Fixes: lintian: upstream-metadata-missing-repository
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-repository.html

commit bc103512d2050572375162a057e3015e022e2510
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Jul 17 19:40:13 2020 +0000

    Replace spaces in short license names with dashes.
    
    Changes-By: lintian-brush
    Fixes: lintian: space-in-std-shortname-in-dep5-copyright
    See-also: https://lintian.debian.org/tags/space-in-std-shortname-in-dep5-copyright.html

commit de3e7f9d05821dede1615564df07c28c4231b435
Author: Michael Fladischer <FladischerMichael@fladi.at>
Date:   Thu Feb 27 22:01:39 2020 +0100

    Provide virtual package httpd-wsgi3.

commit d82a32fee352f7bbd003b762fc94686ef8a664e4
Author: Louis-Philippe Véronneau <pollo@debian.org>
Date:   Sat Jan 18 21:34:31 2020 -0500

    d/control: update the VCS links. (Closes: 946103)

https://salsa.debian.org/api/v4/projects/debian%2Fwaitress API request failed: 404 Not Found at /srv/qa.debian.org/data/vcswatch/vcswatch line 379.

Created: 2020-01-25 Last update: 2020-10-26 11:36

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

python-waitress-doc could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2020-10-30 16:30

4 ignored security issues in stretch low

There are 4 open security issues in stretch.

4 issues skipped by the security teams:

CVE-2019-16785: Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
CVE-2019-16786: Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
CVE-2019-16789: In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
CVE-2019-16792: Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Please fix them.

Created: 2019-12-24 Last update: 2020-08-07 06:08

4 ignored security issues in buster low

There are 4 open security issues in buster.

4 issues skipped by the security teams:

CVE-2019-16785: Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
CVE-2019-16786: Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
CVE-2019-16789: In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
CVE-2019-16792: Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Please fix them.

Created: 2019-12-24 Last update: 2020-08-07 06:08

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.4.1).

Created: 2020-01-21 Last update: 2020-01-21 05:05

news

[rss feed]

[2020-01-06] waitress 1.4.1-1 MIGRATED to testing (Debian testing watch)
[2020-01-01] Accepted waitress 0.8.9-2+deb8u1 (source all) into oldoldstable (Chris Lamb)
[2020-01-01] Accepted waitress 1.4.1-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-09-18] waitress 1.3.1-4 MIGRATED to testing (Debian testing watch)
[2019-09-12] Accepted waitress 1.3.1-4 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-09-12] Accepted waitress 1.3.1-3 (all source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-09-12] Accepted waitress 1.3.1-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2019-01-14] waitress 1.2.0~b2-2 MIGRATED to testing (Debian testing watch)
[2019-01-08] Accepted waitress 1.2.0~b2-2 (all source) into unstable (Andrej Shadura)
[2019-01-07] Accepted waitress 1.2.0~b2-1 (source) into unstable (Andrej Shadura)
[2018-05-15] waitress 1.1.0-1 MIGRATED to testing (Debian testing watch)
[2018-05-13] Accepted waitress 1.1.0-1 (source) into unstable (Andrej Shadura)
[2016-12-24] waitress 1.0.1-1 MIGRATED to testing (Debian testing watch)
[2016-12-13] Accepted waitress 1.0.1-1 (source) into unstable (Andrew Shadura)
[2016-01-01] waitress 0.8.10-1 MIGRATED to testing (Debian testing watch)
[2015-12-26] Accepted waitress 0.8.10-1 (source) into unstable (Andrew Shadura)
[2014-10-24] waitress 0.8.9-2 MIGRATED to testing (Britney)
[2014-10-13] Accepted waitress 0.8.9-2 (source all) into unstable (Andrew Shadura)
[2014-10-08] Accepted waitress 0.8.9-1 (source all) into unstable (Andrew Shadura)
[2014-05-04] waitress 0.8.8-3 MIGRATED to testing (Debian testing watch)
[2014-04-24] Accepted waitress 0.8.8-3 (source all) (Andrew Shadura)
[2014-04-24] Accepted waitress 0.8.8-2 (source all) (Andrew Shadura)
[2013-12-25] waitress 0.8.8-1 MIGRATED to testing (Debian testing watch)
[2013-12-14] Accepted waitress 0.8.8-1 (source all) (Andrew Shadura)
[2013-12-14] Accepted waitress 0.8.7-3 (source all) (Andrew Shadura)
[2013-10-14] waitress 0.8.7-2 MIGRATED to testing (Debian testing watch)
[2013-10-03] Accepted waitress 0.8.7-2 (source all) (Andrew Shadura)
[2013-10-02] Accepted waitress 0.8.7-1 (source all) (Andrew Shadura)
[2013-10-02] waitress 0.8.1-2 MIGRATED to testing (Debian testing watch)
[2013-09-21] Accepted waitress 0.8.1-2 (source all) (Andrew Shadura)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (2, 6)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.1-1