Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::highavailability | pcs | 0:0.10.15-4.el8_8.12 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::highavailability | pcs-snmp | 0:0.10.15-4.el8_8.12 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::highavailability | pcs | 0:0.10.15-4.el8_8.12 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::highavailability | pcs-snmp | 0:0.10.15-4.el8_8.12 |
Vulnerabilities 2
-
High 7.5
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to pe…
-
High 7.5
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2526562
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2533918
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84844.json
-
report
https://access.redhat.com/security/cve/CVE-2024-14029
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-14029
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-14029
-
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
-
article
https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding
-
report
https://access.redhat.com/security/cve/CVE-2026-82397
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-82397
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-82397
-
article
https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
-
article
https://github.com/tornadoweb/tornado/pull/3704
-
article
https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
-
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4