FEDORA-2016-a3618d9ef6 created by orion 3 years ago for Fedora 24
stable

Update to 4.4.2

Security fixes

  • A difference in cookie parsing between Tornado and web browsers (especially when combined with Google Analytics) could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack.

Backwards-compatibility notes

  • Cookies containing certain special characters (in particular semicolon and square brackets) are now parsed differently.
  • If the cookie header contains a combination of valid and invalid cookies, the valid ones will be returned (older versions of Tornado would reject the entire header for a single invalid cookie).

See also http://tornado.readthedocs.io/en/stable/releases/v4.4.0.html

How to install

sudo dnf upgrade --advisory=FEDORA-2016-a3618d9ef6

This update has been submitted for testing by orion.

3 years ago

orion edited this update.

3 years ago

This update has been pushed to testing.

3 years ago

This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes

3 years ago

This update has been submitted for stable by orion.

3 years ago

This update has been pushed to stable.

3 years ago

Please login to add feedback.

Metadata
Type
security
Karma
0
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
disabled
Dates
submitted
3 years ago
in testing
3 years ago
in stable
3 years ago
modified
3 years ago
BZ#1399570 python-tornado: XSRF protection bypass via cookie parsing differences
0
0
BZ#1399571 python-tornado: XSRF protection bypass via cookie parsing differences [fedora-24]
0
0

Automated Test Results