python-tornado: side-channel attack
| Package(s): | python-tornado | CVE #(s): | CVE-2014-9720 | ||||||||||||||||||||||||
| Created: | June 9, 2015 | Updated: | May 16, 2016 | ||||||||||||||||||||||||
| Description: | From the Tornado 3.2.2 release announcement:
The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy). | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||