FEDORA-2016-24478a88fe — security update for python-tornado

stable

FEDORA-2016-24478a88fe created by orion 6 years ago for Fedora 25

Update to 4.4.2:

Security fixes

A difference in cookie parsing between Tornado and web browsers (especially when combined with Google Analytics) could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack.

Backwards-compatibility notes

Cookies containing certain special characters (in particular semicolon and square brackets) are now parsed differently.
If the cookie header contains a combination of valid and invalid cookies, the valid ones will be returned (older versions of Tornado would reject the entire header for a single invalid cookie).

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2016-24478a88fe

This update has been submitted for testing by orion.

This update has been pushed to testing.

This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes

This update has been submitted for stable by orion.

This update has been pushed to stable.

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Builds

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

6 years ago

in testing

6 years ago

in stable

6 years ago

python-tornado-4.4.2-1.fc25

None