Summary
It was discovered that Tornado incorrectly handled a certain redirect.
A remote attacker could possibly use this issue to redirect a user to an
arbitrary web site and conduct a phishing attack by having the user access
a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously
addressed in USN-6159-1. (CVE-2023-28370)
It was discovered that Tornado inefficiently handled requests when parsing
cookies. An attacker could possibly use this issue to increase resource
utilization leading to a denial of service. (CVE-2024-52804)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-tornado | 6.4.0-1ubuntu0.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-tornado | 4.5.3-1ubuntu0.2+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-tornado | 6.0.3+really5.1.1-3ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-tornado | 6.1.0-3ubuntu0.1~esm1 |
Vulnerabilities 2
-
High 7.5
Tornado has HTTP cookie parsing DoS vulnerability
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted coo…
-
Medium 6.1
Open redirect in Tornado
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.