Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:0838-1

Опубликовано: 06 мар. 2026
Источник: suse-cvrf

Описание

Security update for python-tornado

This update for python-tornado fixes the following issue:

  • CVE-2025-67724: missing validation of the supplied reason phrase (bsc#1254903).

Список пакетов

SUSE Linux Enterprise Micro 5.2
python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Micro 5.3
python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Micro 5.4
python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Micro 5.5
python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
python3-tornado-4.5.3-150000.3.16.1

Ссылки

Описание

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

Затронутые продукты
SUSE Linux Enterprise Micro 5.2:python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Micro 5.3:python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Micro 5.4:python3-tornado-4.5.3-150000.3.16.1
SUSE Linux Enterprise Micro 5.5:python3-tornado-4.5.3-150000.3.16.1
Ссылки