Summary
[4.2.1-5.0.1]
- Fixed CVE-2025-47287 Raise errors instead of logging [Orabug: 38049949]
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | python-tornado | 0:4.2.1-5.0.1.el7 |
| Oracle Linux · 7 | python-tornado-doc | 0:4.2.1-5.0.1.el7 |
Vulnerabilities 1
-
High 7.5
Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate…