Debian alert DLA-4007-1 (python-tornado)

From:
             
 
Daniel Leidert <dleidert@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4007-1] python-tornado security update
Date:
             
 
Wed, 01 Jan 2025 03:31:42 +0100
Message-ID:
             
 
<c9d2b34fa6e3006cd812996404a8d916ca9bfc3f.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4007-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
January 01, 2025                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-tornado
Version        : 6.1.0-1+deb11u1
CVE ID         : CVE-2023-28370 CVE-2024-52804
Debian Bug     : 1036875 1088112

Tornado is a scalable, non-blocking Python web framework and
asynchronous networking library.

CVE-2023-28370

    An open redirect vulnerability in Tornado versions 6.3.1 and earlier allows
    a remote unauthenticated attacker to redirect a user to an arbitrary web
    site and conduct a phishing attack by having the user access a specially
    crafted URL.

CVE-2024-52804

    The algorithm used for parsing HTTP cookies in Tornado versions prior to
    6.4.2 sometimes has quadratic complexity, leading to excessive CPU
    consumption when parsing maliciously-crafted cookie headers. This
    parsing occurs in the event loop thread and may block the processing of
    other requests.

For Debian 11 bullseye, these problems have been fixed in version
6.1.0-1+deb11u1.

We recommend that you upgrade your python-tornado packages.

For the detailed security status of python-tornado please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-tornado

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJIBAABCgAyFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmd0qQ4UHGRsZWlkZXJ0
QGRlYmlhbi5vcmcACgkQS80FZ8KW0F30wRAAyJdTXCYMZ6TPVexA/I9NK4OVVY6w
MBaxyFpLQVOeJg9ZwwprR/MwuS7rkVe4d9eu7+V+6XAd2YbFF+EGOCrJcuJS0Yjo
8wBHqF+P5Y9nIlVsE+kjOz0eOAM+amydcHutrWygDEwSjqXzkVcMnBrHLjQrqKAa
uvGdg9Rqg+DxzYa27h/Dh+oRtgMsAjp/eV6zNWFc+1K7NTLcMGsP8BChHlYWQ6b4
F8SD/y+RD+j5lcWjiIFxJ5VKS3F4wzITiO+0nZ3NNGNoDR4m1gszTAb6S9QQ0xyV
8puW9cLxuqwDvcbtrbjeUV0gKL2uL7Eg1QPQ+m15BKFU8EN6w9O4GFkwFpoBbNR0
YpuH3icdC6KshdqiYoYD5a4N81m0WDhrH4UoWPD+ZkCgfrfCbtDjTI6rV7kWr2MR
PkfMWmPUZ2DqlNVR6jb4ezKctvgTfMtJEMJ2F4A85Du2MC8jO5foRsBIBCpdENOR
Pr0Bj5YTZOhC+CnEnl0cWj8AiNG7AJLeoFetQgdw7OaNzcqgXhlZkhyFgJNhXRga
vERgwGLz7UCTm2ApJ58Vnq5aaCqWJB23oClifS5ywQis44PlORM6O6VY89Vb95Jg
EtIj3PPddigEh0Qquy1siqeQMIf5ZNpEfnRUeizadu41pHQgIni8OaQz3akaMJr+
rd+twV9rTaVsbAA=
=T/O/
-----END PGP SIGNATURE-----