Summary
[6.5.5-1.1]
- Update to 6.5.5
Resolves: RHEL-160941
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3-tornado | 0:6.5.5-1.el9_7.1 |
Vulnerabilities 2
-
High 8.7
Tornado has a DoS due to too many multipart parts
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the …
-
High 7.2
Tornado has incomplete validation of cookie attributes
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.