Package "python-tornado-doc"
| Name: |
python-tornado-doc
|
Description: |
scalable, non-blocking web server and tools - documentation
|
| Latest version: |
6.4.0-1ubuntu0.7 |
| Release: |
noble (24.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
python-tornado |
| Homepage: |
https://www.tornadoweb.org/ |
Links
Download "python-tornado-doc"
Other versions of "python-tornado-doc" in Noble
Changelog
|
python-tornado (6.4.0-1ubuntu0.7) noble-security; urgency=high
* SECURITY REGRESSION: Fix static file serving for StaticFileHandler
subclasses that override initialize() (LP: #2172317)
- debian/patches/regression-allowed-symlink-directory.patch: give
allowed_symlink_directory a class-level default and resolve it in
validate_absolute_path, fixing the AttributeError introduced by the
CVE-2026-103263 fix that broke Jupyter.
-- Chrisa Oikonomou Wed, 04 Nov 2026 17:03:12 +0200
|
| Source diff to previous version |
| 2172317 |
python3-tornado 6.5.4-0.1ubuntu0.2 breaks Jupyter Notebook |
| CVE-2026-103263 |
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirmi |
|
|
python-tornado (6.4.0-1ubuntu0.6) noble-security; urgency=medium
* SECURITY UPDATE: HTTP request smuggling.
- debian/patches/CVE-2024-14029.patch: Reject duplicate Transfer-Encoding
headers and conflicting Transfer-Encoding/Content-Length combinations in
tornado/http1connection.py. Add tests in tornado/test/httpserver_test.py.
- CVE-2024-14029
* SECURITY UPDATE: denial of service.
- debian/patches/CVE-2026-91990.patch: Limit the number of multipart
parts to 100 in tornado/httputil.py. Add tests in
tornado/test/httputil_test.py.
- CVE-2026-91990
* SECURITY UPDATE: credential leak.
- debian/patches/CVE-2026-91992.patch: Do not reuse curl handles across
requests in tornado/curl_httpclient.py, so proxy credentials and client
certificates are not leaked between requests. Add tests in
tornado/test/curl_httpclient_test.py.
- CVE-2026-91992
* SECURITY UPDATE: denial of service.
- debian/patches/CVE-2026-103262.patch: Enforce max_body_size for
streaming responses and decompression bombs in
tornado/curl_httpclient.py. Add tests in
tornado/test/curl_httpclient_test.py.
- CVE-2026-103262
* SECURITY UPDATE: path traversal.
- debian/patches/CVE-2026-103263.patch: Resolve symlinks before checking
the root path in tornado/web.py, preventing access outside the static
root. Add tests in tornado/test/web_test.py.
- CVE-2026-103263
-- Chrisa Oikonomou Wed, 14 Oct 2026 15:24:59 +0300
|
| Source diff to previous version |
| CVE-2024-14029 |
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body a |
| CVE-2026-91990 |
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_ |
| CVE-2026-91992 |
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper s |
| CVE-2026-103262 |
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause den |
| CVE-2026-103263 |
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirmi |
|
|
python-tornado (6.4.0-1ubuntu0.5) noble-security; urgency=medium
* SECURITY UPDATE: Denial of service when parsing large multipart bodies.
- debian/patches/CVE-2026-31958.patch: Add limit of 100 parts and enforce
checks in tornado/httputil.py. Add tests in
tornado/test/httputil_test.py.
- CVE-2026-31958
* SECURITY UPDATE: Cookie attribute injection.
- debian/patches/CVE-2026-35536.patch: Raise CookieError on invalid
characters in tornado/web.py. Add tests in tornado/test/web_test.py.
- CVE-2026-35536
-- Hlib Korzhynskyy <email address hidden> Fri, 17 Apr 2026 14:00:58 -0230
|
| Source diff to previous version |
| CVE-2026-31958 |
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts i |
| CVE-2026-35536 |
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were n |
|
|
python-tornado (6.4.0-1ubuntu0.4) noble-security; urgency=medium
* SECURITY UPDATE: Cross site scripting in custom HTTP headers.
- debian/patches/CVE-2025-67724-pre*.patch: Restrict headers to printable
ASCII characters in tornado/httputil.py.
- debian/patches/CVE-2025-67724.patch: Add check for "<" and add
escape.xhtml_escape in status messages in tornado/web.py. Add tests in
tornado/test/web_test.py.
- CVE-2025-67724
* SECURITY UPDATE: Denial of service due to malicious HTTP requests with
repeated header names.
- debian/patches/CVE-2025-67725.patch: Replace self._dict with
self._combined_cache in tornado/httputil.py. Add tests in
tornado/test/httputil_test.py.
- debian/patches/CVE-2025-67725-post1.patch: Fix in-operator being case
sensitive due to last patch changes in tornado/httputil.py. Add tests in
tornado/test/httputil_test.py.
- CVE-2025-67725
* SECURITY UPDATE: Denial of service due to inefficient parsing of HTTP
header values.
- debian/patches/CVE-2025-67726.patch: Change _parseparam logic in
tornado/httputil.py. Add tests in tornado/test/httputil_test.py.
- CVE-2025-67726
-- Hlib Korzhynskyy <email address hidden> Wed, 07 Jan 2026 10:40:48 -0330
|
| Source diff to previous version |
| CVE-2025-67724 |
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in H |
| CVE-2025-67725 |
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can blo |
| CVE-2025-67726 |
Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters |
|
|
python-tornado (6.4.0-1ubuntu0.2) noble-security; urgency=medium
* SECURITY UPDATE: denial of service
- debian/patches/CVE-2025-47287.patch: httputil: Raise errors
instead of logging in multipart/form-data parsing
- CVE-2025-47287
-- Shishir Subedi <email address hidden> Mon, 19 May 2025 15:11:21 +0545
|
| CVE-2025-47287 |
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it lo |
|
About
-
Send Feedback to @ubuntu_updates
