Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:1171-1

Опубликовано: 02 апр. 2026
Источник: suse-cvrf

Описание

Security update for python-tornado

This update for python-tornado fixes the following issues:

  • CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
  • incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes (bsc#1259630).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Micro 5.2
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Micro 5.3
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Micro 5.4
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Micro 5.5
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Server 15 SP4-LTSS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Server 15 SP5-LTSS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Server 15 SP6-LTSS
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
python3-tornado-4.5.3-150000.3.19.1

Ссылки

Описание

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python3-tornado-4.5.3-150000.3.19.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python3-tornado-4.5.3-150000.3.19.1
Ссылки