Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Tornado Python Server Flaw Allows Malicious Code Execution
published 1 year ago
Summary
A security update is available for the Tornado Python web server software. This update fixes a flaw that could allow an attacker to execute malicious code on a server running Tornado. Affected users should update their Tornado installations as soon as possible to prevent potential security risks.
What to do
- Update redhat python-tornado to version 0:6.4.2-1.el10_0.1.
- Update redhat python-tornado-debugsource to version 0:6.4.2-1.el10_0.1.
- Update redhat python3-tornado to version 0:6.4.2-1.el10_0.1.
- Update redhat python3-tornado-debuginfo to version 0:6.4.2-1.el10_0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:10.0 | redhat | python-tornado |
< 0:6.4.2-1.el10_0.1 Fix: upgrade to 0:6.4.2-1.el10_0.1
|
| Red Hat:enterprise_linux:10.0 | redhat | python-tornado-debugsource |
< 0:6.4.2-1.el10_0.1 Fix: upgrade to 0:6.4.2-1.el10_0.1
|
| Red Hat:enterprise_linux:10.0 | redhat | python3-tornado |
< 0:6.4.2-1.el10_0.1 Fix: upgrade to 0:6.4.2-1.el10_0.1
|
| Red Hat:enterprise_linux:10.0 | redhat | python3-tornado-debuginfo |
< 0:6.4.2-1.el10_0.1 Fix: upgrade to 0:6.4.2-1.el10_0.1
|
Original advisory text
Red Hat Security Advisory: python-tornado security update
References
- https://access.redhat.com/errata/RHSA-2025:8135 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2366703 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8135.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-47287 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-47287 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47287 Vendor Advisory
- https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7... Third Party Advisory
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 May 2025
Updated12 Jul 2026
First seen12 Jul 2026
Sources
RHSA-2025:8135 · OSV
Track software like this
Free during beta