Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | python-tornado | 0:6.4.2-2.el9_6.2 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | python-tornado-debugsource | 0:6.4.2-2.el9_6.2 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | python3-tornado | 0:6.4.2-2.el9_6.2 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | python3-tornado-debuginfo | 0:6.4.2-2.el9_6.2 |
Vulnerabilities 1
-
High 7.5
Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2366703
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8136.json
-
report
https://access.redhat.com/security/cve/CVE-2025-47287
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-47287
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-47287
-
article
https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3
-
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m