Описание
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the domain, path, and samesite arguments when setting cookies. This could lead to cookie attribute injection, potentially allowing for information disclosure or manipulation of client-side data.
Отчет
This vulnerability is rated as Moderate because successful exploitation requires an application to pass untrusted, user-supplied data into cookie configuration parameters, limiting the risk in standard deployments. In typical Red Hat environments running Tornado web services, cookie attributes such as domain, path, and SameSite policies are statically configured rather than derived from client input. If an application does expose these parameters to untrusted input, the flaw allows injection of supplementary cookie directives, potentially leading to unauthorized client-side state manipulation or session fixation without enabling host-level compromise.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/bitwarden-sdk-server-rhel9 | Affected | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-operator-bundle | Affected | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-operator-rhel9 | Affected | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-rhel9 | Affected | ||
| Lightspeed Core | ansible-automation-platform-26/lightspeed-chatbot-rhel9 | Affected | ||
| Lightspeed Core | openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-ocp-rag-rhel9 | Will not fix | ||
| Red Hat Enterprise Linux 8 | pcs | Not affected | ||
| Red Hat Enterprise Linux 9 | pcs | Not affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
In Tornado before 6.5.5, cookie attribute injection could occur becaus ...
Tornado has cookie attribute injection via .RequestHandler.set_cookie
EPSS
5.4 Medium
CVSS3