Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Python Tornado packages can run malicious code

published 1 year ago

Summary

The Python Tornado libraries provided by Red Hat (python-tornado, python-tornado-debugsource, python3-tornado, and python3-tornado-debuginfo) contain a flaw that could let an attacker execute arbitrary code on a server that uses them. This could lead to unauthorized actions or data loss. Apply the Red Hat security update for these packages as soon as possible to close the gap.

What to do

Update redhat python-tornado to version 0:6.4.2-1.el9_2.
Update redhat python-tornado-debugsource to version 0:6.4.2-1.el9_2.
Update redhat python3-tornado to version 0:6.4.2-1.el9_2.
Update redhat python3-tornado-debuginfo to version 0:6.4.2-1.el9_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.2::appstream	redhat	python-tornado	< 0:6.4.2-1.el9_2 Fix: upgrade to 0:6.4.2-1.el9_2
Red Hat:rhel_eus:9.2::appstream	redhat	python-tornado-debugsource	< 0:6.4.2-1.el9_2 Fix: upgrade to 0:6.4.2-1.el9_2
Red Hat:rhel_eus:9.2::appstream	redhat	python3-tornado	< 0:6.4.2-1.el9_2 Fix: upgrade to 0:6.4.2-1.el9_2
Red Hat:rhel_eus:9.2::appstream	redhat	python3-tornado-debuginfo	< 0:6.4.2-1.el9_2 Fix: upgrade to 0:6.4.2-1.el9_2

Original advisory text

Red Hat Security Advisory: python-tornado security update

References

https://access.redhat.com/errata/RHSA-2024:10836 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2328045 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10836.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-14029 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2533918 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-14029 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-14029 Vendor Advisory
https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g Third Party Advisory
https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-52804 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-52804 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52804 Vendor Advisory
https://github.com/advisories/GHSA-7pwv-g7hj-39pr Vendor Advisory
https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b1982... Third Party Advisory
https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published6 Dec 2024

Updated10 Oct 2026

First seen10 Oct 2026

Sources

RHSA-2024:10836 · OSV

Track software like this

Free during beta