Описание
Security update for python-tornado6
This update for python-tornado6 fixes the following issues:
- CVE-2025-47287: excessive logging when parsing malformed
multipart/form-datacan lead to a denial-of-service (bsc#1243268).
Список пакетов
SUSE Linux Enterprise Module for Python 3 15 SP7
python311-tornado6-6.3.2-150400.9.9.1
Ссылки
- Link for SUSE-SU-2025:01649-2
- E-Mail link for SUSE-SU-2025:01649-2
- SUSE Security Ratings
- SUSE Bug 1243268
- SUSE CVE CVE-2025-47287 page
Описание
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.
Затронутые продукты
SUSE Linux Enterprise Module for Python 3 15 SP7:python311-tornado6-6.3.2-150400.9.9.1
Ссылки
- CVE-2025-47287
- SUSE Bug 1243268