{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"python-tornado security update", "category":"general", "title":"Synopsis" }, { "text":"An update for python-tornado is now available for openEuler-24.03-LTS-SP4", "category":"general", "title":"Summary" }, { "text":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\n\nSecurity Fix(es):\n\nTornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397)\n\nTornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029)\n\nTornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384)\n\nTornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.(CVE-2026-91990)\n\nTornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.(CVE-2026-91991)\n\nTornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.(CVE-2026-91992)", "category":"general", "title":"Description" }, { "text":"An update for python-tornado is now available for openEuler-20.03-LTS-SP4/openEuler-24.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"python-tornado", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-4036", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" }, { "summary":"CVE-2023-54397", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-54397&packageName=python-tornado" }, { "summary":"CVE-2024-14029", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-14029&packageName=python-tornado" }, { "summary":"CVE-2024-58384", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-58384&packageName=python-tornado" }, { "summary":"CVE-2026-91990", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-91990&packageName=python-tornado" }, { "summary":"CVE-2026-91991", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-91991&packageName=python-tornado" }, { "summary":"CVE-2026-91992", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-91992&packageName=python-tornado" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54397" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14029" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58384" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91990" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91991" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91992" }, { "summary":"openEuler-SA-2026-4036 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4036.json" } ], "title":"An update for python-tornado is now available for openEuler-24.03-LTS-SP4", "tracking":{ "initial_release_date":"2026-09-30T16:00:54+08:00", "revision_history":[ { "date":"2026-09-30T16:00:54+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-09-30T16:00:54+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-09-30T16:00:54+08:00", "id":"openEuler-SA-2026-4036", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"openEuler-24.03-LTS-SP4", "name":"openEuler-24.03-LTS-SP4" }, "name":"openEuler-24.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python-tornado-6.5.10-1.oe2403sp4.src.rpm", "name":"python-tornado-6.5.10-1.oe2403sp4.src.rpm" }, "name":"python-tornado-6.5.10-1.oe2403sp4.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64.rpm", "name":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64.rpm" }, "name":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64.rpm", "name":"python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64.rpm" }, "name":"python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python3-tornado-6.5.10-1.oe2403sp4.aarch64.rpm", "name":"python3-tornado-6.5.10-1.oe2403sp4.aarch64.rpm" }, "name":"python3-tornado-6.5.10-1.oe2403sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64.rpm", "name":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64.rpm" }, "name":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64.rpm", "name":"python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64.rpm" }, "name":"python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python3-tornado-6.5.10-1.oe2403sp4.x86_64.rpm", "name":"python3-tornado-6.5.10-1.oe2403sp4.x86_64.rpm" }, "name":"python3-tornado-6.5.10-1.oe2403sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"python-tornado-help-6.5.10-1.oe2403sp4.noarch.rpm", "name":"python-tornado-help-6.5.10-1.oe2403sp4.noarch.rpm" }, "name":"python-tornado-help-6.5.10-1.oe2403sp4.noarch.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python-tornado-6.5.10-1.oe2403sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "name":"python-tornado-6.5.10-1.oe2403sp4.src as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "name":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "name":"python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python3-tornado-6.5.10-1.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "name":"python3-tornado-6.5.10-1.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "name":"python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "name":"python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python3-tornado-6.5.10-1.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "name":"python3-tornado-6.5.10-1.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"python-tornado-help-6.5.10-1.oe2403sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch", "name":"python-tornado-help-6.5.10-1.oe2403sp4.noarch as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2023-54397", "notes":[ { "text":"Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ], "details":"python-tornado security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2023-54397" }, { "cve":"CVE-2024-14029", "notes":[ { "text":"Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ], "details":"python-tornado security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2024-14029" }, { "cve":"CVE-2024-58384", "notes":[ { "text":"Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ], "details":"python-tornado security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.4, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2024-58384" }, { "cve":"CVE-2026-91990", "notes":[ { "text":"Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ], "details":"python-tornado security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-91990" }, { "cve":"CVE-2026-91991", "notes":[ { "text":"Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ], "details":"python-tornado security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.4, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-91991" }, { "cve":"CVE-2026-91992", "notes":[ { "text":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ], "details":"python-tornado security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.9, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:python-tornado-6.5.10-1.oe2403sp4.src", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python3-tornado-6.5.10-1.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:python-tornado-help-6.5.10-1.oe2403sp4.noarch" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-91992" } ] }