FEDORA-EPEL-2020-fa8a2e97c6 — security update for python-waitress

stable

python-waitress-1.4.3-1.el7

FEDORA-EPEL-2020-fa8a2e97c6 created by kevin 5 years ago for Fedora EPEL 7

Update to 1.4.3 to fix a number of CVEs: CVE-2019-16786 CVE-2019-16785 CVE-2019-16789

Note: This is a large jump in versions for epel7, but as far as I can see there's no incompatible changes in the changelog.

Please test!

This update has been submitted for testing by kevin.

5 years ago

This update's test gating status has been changed to 'waiting'.

5 years ago

This update's test gating status has been changed to 'ignored'.

5 years ago

This update has been pushed to testing.

5 years ago

This update can be pushed to stable now if the maintainer wishes

5 years ago

This update's test gating status has been changed to 'greenwave_failed'.

5 years ago

This update's test gating status has been changed to 'ignored'.

5 years ago

pgreco commented & provided feedback 4 years ago

Doing some cleanup, can we release or drop this? Stable by time is disabled, but it has been waiting for over 6 months

This update has been submitted for stable by kevin.

4 years ago

This update has been pushed to stable.

4 years ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

5 years ago

in testing

5 years ago

in stable

4 years ago

Builds

python-waitress-1.4.3-1.el7

BZ#1468175 Backport security fix from v1.0.0 to prevent header spoofing via underscore/dash conflation

BZ#1785591 python-waitress-1.4.3 is available

BZ#1789810 CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [epel-all]

BZ#1791417 CVE-2019-16786 python-waitress: waitress: HTTP request smuggling through invalid Transfer-Encoding [epel-all]

BZ#1791421 CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [epel-all]

python-waitress-1.4.3-1.el7

Automated Test Results

ignored