Summary
USN-8952-2 fixed a regression in Tornado that broke static file serving
for applications that subclass Tornado's StaticFileHandler, such as
Jupyter. Unfortunately, that update's incomplete fix could introduce a regression by rejecting symlinks into system
directories like /usr/share, which distribution packages use for their
JavaScript and fonts, causing web UIs to return 403 errors. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-tornado | 6.4.0-1ubuntu0.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.4 |
| Ubuntu · 26.10 | python-tornado | 6.5.5-5ubuntu1.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-tornado | 4.2.1-1ubuntu3.1+esm6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-tornado | 4.5.3-1ubuntu0.2+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-tornado | 6.0.3+really5.1.1-3ubuntu0.1~esm9 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-tornado | 6.1.0-3ubuntu0.1~esm8 |
Vulnerabilities 1
-
Medium 5.9
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it,…