Summary
USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due
to an incomplete fix for CVE-2026-103263, which broke static file
serving for applications that subclass Tornado's StaticFileHandler,
such as Jupyter, and could introduce a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-tornado | 6.4.0-1ubuntu0.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.3 |
| Ubuntu · 26.10 | python-tornado | 6.5.5-5ubuntu1.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-tornado | 4.2.1-1ubuntu3.1+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-tornado | 4.5.3-1ubuntu0.2+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-tornado | 6.0.3+really5.1.1-3ubuntu0.1~esm8 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-tornado | 6.1.0-3ubuntu0.1~esm7 |
Vulnerabilities 1
-
Medium 5.9
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it,…