Описание
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needed | |
| esm-apps/bionic | released | 4.5.3-1ubuntu0.2+esm3 |
| esm-apps/focal | released | 6.0.3+really5.1.1-3ubuntu0.1~esm5 |
| esm-apps/jammy | released | 6.1.0-3ubuntu0.1~esm5 |
| esm-infra-legacy/xenial | released | 4.2.1-1ubuntu3.1+esm3 |
| esm-infra/xenial | released | 4.2.1-1ubuntu3.1+esm3 |
| jammy | needed | |
| noble | released | 6.4.0-1ubuntu0.5 |
| questing | released | 6.4.2-3ubuntu0.3 |
| resolute | released | 6.5.4-0.1ubuntu0.1 |
Показывать по
EPSS
7.5 High
CVSS3
Связанные уязвимости
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Tornado is a Python web framework and asynchronous networking library. ...
EPSS
7.5 High
CVSS3