[USN-7115-1] Waitress vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEELOLXZEFYQHcSWEHiyfW2m9Ldu6sFAmc8wikFAwAAAAAACgkQyfW2m9Ldu6s3
4A//f0QDjUNRx0jrYtT5Vo3qkNotYU9PeshzhAZkS8S04s2Gb+TPl1If1P85FhN1rgTieBUM6o+H
2ytYLQs/jtVKcrCaNTTnq6abLeYTG9AQfMGtRWGRiW1nE9f+9ps05bft+Ydy48b5OzQLxNIXjIz6
FKZkehMrBx+vGksaWWdaFNdkGVSdsNqrVJ2qSFSifDPYIQAsVaXaz0oZ82kC9yM0aR/M2ANe4oVW
R+NlueNMlMZMSjmaXS1mfLtOTn+8ZXUhWXTNxL/LWDwAHXOFdUl+D7pZsKpDs/ch5G80VhhvNJgM
eOtFHJXHi0qbalQNCRmbmzwlz2fktijdkWBOvbUAswncpxk4uyGc7/vagUtz/owsXeAqGWIriJll
jCQzFL/nrJZfCxPtL3moPH+hjBA/llTK3/5d/2OSnfCvfHru5UlX2mn6PCfBXBRSjhyGiSetAxSr
ka8z5fnPz5ef9ioVxfeWh6/EPpSLPVjG9YGo0YtE1tYkOwYakv8wLa39Uo4262aAFvf+Gt4slQc/
2M5Xy+JZBLLtp9C8Z9D/ByxQSVYCEAQkRqCxKuiVwhfNRW04OZWpaNLg1JC2BfyfqcIbUt8DjNrr
bClCY726SeIlhVynig3PlTqQSg1FPG2hTTDJXgpIOAMzbvmiC3h7symAnemx7q5U8wY7FwgKVH4E
wB0=
=hacd
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7115-1
November 19, 2024

Waitress vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Waitress.

Software Description:
- waitress: production-quality pure-Python WSGI server

Details:

It was discovered that Waitress could process follow up requests when
receiving a specially crafted message. An attacker could use this issue to
have the server process inconsistent client requests. (CVE-2024-49768)

Dylan Jay discovered that Waitress could be lead to write to an unexisting
socket after closing the remote connection. An attacker could use this
issue to increase resource utilization leading to a denial of service.
(CVE-2024-49769)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
  python3-waitress                3.0.0-1ubuntu0.1

Ubuntu 24.04 LTS
  python3-waitress                2.1.2-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  python3-waitress                1.4.4-1.1ubuntu1.1

Ubuntu 20.04 LTS
  python3-waitress                1.4.1-1ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7115-1
  CVE-2024-49768, CVE-2024-49769

Package Information:
  https://launchpad.net/ubuntu/+source/waitress/3.0.0-1ubuntu0.1
  https://launchpad.net/ubuntu/+source/waitress/1.4.4-1.1ubuntu1.1
  https://launchpad.net/ubuntu/+source/waitress/1.4.1-1ubuntu0.2