Summary
[0.10.18-2.0.1.el8_10.10]
- Replaced HAM-logo
[0.10.18-2.el8_10.10]
- Fixed CVE-2026-82397, CVE-2024-14029 by patching bundled Tornado
Resolves: RHEL-271884, RHEL-271929
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | pcs | 0:0.10.18-2.0.1.el8_10.10 |
| Oracle Linux · 8 | pcs-snmp | 0:0.10.18-2.0.1.el8_10.10 |
Vulnerabilities 2
-
High 7.5
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to pe…
-
High 7.5
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…