Debian alert DLA-4520-1 (python-tornado)

From:
             
 
Daniel Leidert <dleidert@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4520-1] python-tornado security update
Date:
             
 
Wed, 01 Apr 2026 12:46:05 +0200
Message-ID:
             
 
<e4a907f3e91165e222262973639d2bbad73ecbee.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4520-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
April 01, 2026                                https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-tornado
Version        : 6.1.0-1+deb11u4
CVE ID         : CVE-2026-31958
Debian Bug     : 1130507 1132367

Tornado is a scalable, non-blocking Python web framework and
asynchronous networking library.

CVE-2026-31958


   Introduce new limits on the size and complexity of multipart bodies,
   including a default limit of 100 parts per request to mitigate a
   possible DoS. It is also possible to disable parsing multipart/form-
   data entirely if not required

GHSA-78cv-mqj4-43f7 (CVE not available yet)

   Values passed to the domain, path, and samesite arguments of
   RequestHandler.set_cookie are not completely validated. In
   particular, semicolons are allowed, which could be used to inject
   attacker-controlled values for other cookie attributes.

For Debian 11 bullseye, this problem has been fixed in version
6.1.0-1+deb11u4.

We recommend that you upgrade your python-tornado packages.

For the detailed security status of python-tornado please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-tornado

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJIBAABCgAyFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmnM920UHGRsZWlkZXJ0
QGRlYmlhbi5vcmcACgkQS80FZ8KW0F23Pg//dkquzZ25IVYUeQgBCLKLOqqEaAYm
N4Is+pg0kne8rVKzhkAdMQR6NO4ClAjw/PexGljl3z22rZ6bOidJ0XZif2i33QFW
p5yf2ajhJKYUZ3zVioAJDtOA2iqHWjfEVr9/scjqmE6AfxhliA2JwD+mWblhwpfj
AaWo6ArjGsnw3tvYb3sB9RqkTGlMohNxC21huKOVp/ybbtSmu/bi7om6EzAOMIxD
zSKX5TxlqLQqAWono4vzoRXRKmSKGFGKULJrwA95XI3O2q2ZTreTekKlLjZKwWHH
NpaR1RclxNRritvATNn9mZ0yfxeylofUvUCoD5vqpgGAw2aAm1noQJFoN3OaV3qd
QlBNzd5Y1V43GQ7bceOnqY8rmWyBZ7tvWhxYemfDPUalEwnufWi+uONZzhh4vjDQ
LJT8Fesk1pJQLTHse4fshmoiamNPChlUzYJc7mppVKbO15TUOp9rSallDrUe1EAZ
Prz1Gq4fOd+JZxc2iqnBRVs6YeINCqhsMj+GlyDj6wK/gSGDAlEmHO80Pf22OWWx
5p6mq9pVaWbVfbgrPPvF+YtaX3/gFRzRCdGnJ3mljha270tJSj6nbTx6QLRsXRZu
mjpRmLY2LpgyITaxUVCOfHo5PuL9hTdaxqiBEJCNdaBfpMJpueO7BzIn5ztNOcef
sT7esJH0CnVMLI4=
=P7iD
-----END PGP SIGNATURE-----