Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Tornado Web Server on Red Hat Systems at Risk of Data Exposure
published 1 year ago
Summary
The Tornado web server, used by some Red Hat systems, contains a security flaw that could allow an attacker to access sensitive information. This issue affects the security of data on affected systems. Red Hat has released a security update to fix this issue.
What to do
- Update redhat python-tornado to version 0:6.4.2-2.el9_6.2.
- Update redhat python-tornado-debugsource to version 0:6.4.2-2.el9_6.2.
- Update redhat python3-tornado to version 0:6.4.2-2.el9_6.2.
- Update redhat python3-tornado-debuginfo to version 0:6.4.2-2.el9_6.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:9::appstream | redhat | python-tornado |
< 0:6.4.2-2.el9_6.2 Fix: upgrade to 0:6.4.2-2.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | python-tornado-debugsource |
< 0:6.4.2-2.el9_6.2 Fix: upgrade to 0:6.4.2-2.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | python3-tornado |
< 0:6.4.2-2.el9_6.2 Fix: upgrade to 0:6.4.2-2.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | python3-tornado-debuginfo |
< 0:6.4.2-2.el9_6.2 Fix: upgrade to 0:6.4.2-2.el9_6.2
|
Original advisory text
Red Hat Security Advisory: python-tornado security update
References
- https://access.redhat.com/errata/RHSA-2025:8136 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2366703 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8136.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-47287 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-47287 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47287 Vendor Advisory
- https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7... Third Party Advisory
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 May 2025
Updated12 Jul 2026
First seen12 Jul 2026
Sources
RHSA-2025:8136 · OSV
Track software like this
Free during beta