CVE-2022-31015

描述

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

如何修補 CVE-2022-31015

要修補 CVE-2022-31015,請將受影響套件升級到下列已修補版本。

• —升級至 2.1.2-1 或更新版本
• —升級至 2.1.2 或更新版本
• —升級至 4f6789b035610e0552738cdc4b35ca809a592d48 或更新版本

CVE-2022-31015 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.1.2-1
• >= 2.1.0, < 2.1.2
• from 0, < 4f6789b035610e0552738cdc4b35ca809a592d48 | >= 2.1.0, < 2.1.2

CVSS 分數

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-31015
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-31015
• PATCHgithub.com/Pylons/waitress
• WEBgithub.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48
• WEB