Threat Intelligence Database

A command injection vulnerability exists in the tqdm Python package used by icloudpd, where certain non-boolean CLI arguments are unsafely passed to Python's eval function, enabling arbitrary code execution. This affects icloudpd versions from 1.17.3 up to but not including 1.21.0. A fix has been released in tqdm version 4.66.3. No workarounds are available.

CVE-2024-49769 is a denial-of-service vulnerability in the waitress server used by icloudpd. When a remote client closes the connection prematurely, waitress fails to clean up the socket properly, causing the main thread to enter a busy loop attempting to write to a non-existent socket. This leads to high CPU usage and resource exhaustion. The issue affects icloudpd versions from 1.21.0 up to but not including 1.25.1. Waitress 3.0.1 includes a fix that resolves this race condition. No workarounds are available.

CVE-2024-49768 is a critical race condition vulnerability in the Waitress HTTP server used by icloudpd. It occurs when HTTP pipelining is enabled with an invalid first request of exactly the recv_bytes length, allowing a secondary request to be processed while the connection should be closed. This can lead to unintended request processing. The issue is fixed in Waitress version 3.0.1. Disabling the channel_request_lookahead feature (default is disabled) is a workaround.

### Impact A remote client may send a request that is exactly `recv_bytes` (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. ### Patches Waitress 3.0.1 fixes the race condition. ### Workarounds Disable `channel_request_lookahead`, this is set to `0` by default disabling this feature. For this vulnerability this value is required to be changed from the default. ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related) * email the Pylons Security mailing list: [[email protected]](mailto:[email protected]) (if security related) ### Thanks - m4yfly and urn1ce From TianGong Team of Legendsec at Qi'anxin Group.