Changelog
*Sourced from [waitress's changelog](https://github.com/Pylons/waitress/blob/master/CHANGES.txt).*
> 1.4.3 (2020-02-02)
> ------------------
>
> Security Fixes
> ~~~~~~~~~~~~~~
>
> - In Waitress version 1.4.2 a new regular expression was added to validate the
> headers that Waitress receives to make sure that it matches RFC7230.
> Unfortunately the regular expression was written in a way that with invalid
> input it leads to catastrophic backtracking which allows for a Denial of
> Service and CPU usage going to a 100%.
>
> This was reported by Fil Zembowicz to the Pylons Project. Please see
> https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc
> for more information.
Commits
- [`cbc89bf`](https://github.com/Pylons/waitress/commit/cbc89bf742ef7cbca17671ec9acd3898491c378f) Prep v1.4.3
- [`6e46f9e`](https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f) Merge pull request from GHSA-73m2-3pwg-5fgc
- [`51b9bd4`](https://github.com/Pylons/waitress/commit/51b9bd429a97ac1cadfe4e37938ff7fac84ee642) Remove accidental backslash
- [`f87abb7`](https://github.com/Pylons/waitress/commit/f87abb7320d9acfa2c321481b70974363966bfe5) Add bad header that caused catastrophic backtracking
- [`2fe8e54`](https://github.com/Pylons/waitress/commit/2fe8e54695ed038dadbb90e03140a1ab395d6629) Add header parsing tests with short headers
- [`ac0ca05`](https://github.com/Pylons/waitress/commit/ac0ca050046f1538346f3975487062186195f4ca) Remove catastrophic backtracking in regex
- See full diff in [compare view](https://github.com/Pylons/waitress/compare/v1.4.2...v1.4.3)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/scieloorg/kernel/network/alerts).
Bumps waitress from 1.4.2 to 1.4.3.
Changelog
*Sourced from [waitress's changelog](https://github.com/Pylons/waitress/blob/master/CHANGES.txt).* > 1.4.3 (2020-02-02) > ------------------ > > Security Fixes > ~~~~~~~~~~~~~~ > > - In Waitress version 1.4.2 a new regular expression was added to validate the > headers that Waitress receives to make sure that it matches RFC7230. > Unfortunately the regular expression was written in a way that with invalid > input it leads to catastrophic backtracking which allows for a Denial of > Service and CPU usage going to a 100%. > > This was reported by Fil Zembowicz to the Pylons Project. Please see > https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc > for more information.Commits
- [`cbc89bf`](https://github.com/Pylons/waitress/commit/cbc89bf742ef7cbca17671ec9acd3898491c378f) Prep v1.4.3 - [`6e46f9e`](https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f) Merge pull request from GHSA-73m2-3pwg-5fgc - [`51b9bd4`](https://github.com/Pylons/waitress/commit/51b9bd429a97ac1cadfe4e37938ff7fac84ee642) Remove accidental backslash - [`f87abb7`](https://github.com/Pylons/waitress/commit/f87abb7320d9acfa2c321481b70974363966bfe5) Add bad header that caused catastrophic backtracking - [`2fe8e54`](https://github.com/Pylons/waitress/commit/2fe8e54695ed038dadbb90e03140a1ab395d6629) Add header parsing tests with short headers - [`ac0ca05`](https://github.com/Pylons/waitress/commit/ac0ca050046f1538346f3975487062186195f4ca) Remove catastrophic backtracking in regex - See full diff in [compare view](https://github.com/Pylons/waitress/compare/v1.4.2...v1.4.3)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/scieloorg/kernel/network/alerts).