Red Hat Security Advisory

RHSA-2024:10590

python-tornado security update

Released 2024-12-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.4.2-1.el9_5, python3-tornado-6.4.2-1.el9_5

Fixes 2 records

TI-2024-13023 CVE-2024-14029 · GHSA-hr42-gv84-2f3g

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

HIGH 72

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00361 Published 2026-09-15 Partial fix · 6.4.1 CWE-444

TI-2024-35317 CVE-2024-52804 · GHSA-8w49-h785-mj3c

Tornado has HTTP cookie parsing DoS vulnerability

MEDIUM 41

Tornado is a Python web framework and asynchronous networking library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01044 Published 2024-11-22 Partial fix · 6.4.2 CWE-400