CVE-2022-31015CWE-248CWE-362

Uncaught Exception (due to a data race) leads to process termination in Waitress

Medium · published May 31, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
74.0
In the wild
Unconfirmed
What it is

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01498 · 74.0th percentile
Weaknesses
CWE-248 · Uncaught Exception; CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2022-05-31T22:50Z
EPSS history
Timeline
  • 31 MAY 22:50Z
    Uncaught Exception (due to a data race) leads to process termination in Waitress
    cvelistv5