An update for python-tornado is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2509 Final 1.0 1.0 2024-12-06 Initial 2024-12-06 2024-12-06 openEuler SA Tool V1.0 2024-12-06 python-tornado security update An update for python-tornado is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4 Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user. Security Fix(es): Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.(CVE-2024-52804) An update for python-tornado is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-tornado https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2509 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-52804 https://nvd.nist.gov/vuln/detail/CVE-2024-52804 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 python-tornado-debuginfo-6.1-3.oe2203sp1.aarch64.rpm python-tornado-debugsource-6.1-3.oe2203sp1.aarch64.rpm python-tornado-help-6.1-3.oe2203sp1.aarch64.rpm python3-tornado-6.1-3.oe2203sp1.aarch64.rpm python-tornado-debuginfo-6.3.3-2.oe2403.aarch64.rpm python-tornado-debugsource-6.3.3-2.oe2403.aarch64.rpm python-tornado-help-6.3.3-2.oe2403.aarch64.rpm python3-tornado-6.3.3-2.oe2403.aarch64.rpm python-tornado-debuginfo-6.1-3.oe2203sp4.aarch64.rpm python-tornado-debugsource-6.1-3.oe2203sp4.aarch64.rpm python-tornado-help-6.1-3.oe2203sp4.aarch64.rpm python3-tornado-6.1-3.oe2203sp4.aarch64.rpm python-tornado-debuginfo-6.1-3.oe2203sp3.aarch64.rpm python-tornado-debugsource-6.1-3.oe2203sp3.aarch64.rpm python-tornado-help-6.1-3.oe2203sp3.aarch64.rpm python3-tornado-6.1-3.oe2203sp3.aarch64.rpm python-tornado-debuginfo-5.0.2-9.oe2003sp4.aarch64.rpm python-tornado-debugsource-5.0.2-9.oe2003sp4.aarch64.rpm python2-tornado-5.0.2-9.oe2003sp4.aarch64.rpm python3-tornado-5.0.2-9.oe2003sp4.aarch64.rpm python-tornado-debuginfo-6.1-3.oe2203sp1.x86_64.rpm python-tornado-debugsource-6.1-3.oe2203sp1.x86_64.rpm python-tornado-help-6.1-3.oe2203sp1.x86_64.rpm python3-tornado-6.1-3.oe2203sp1.x86_64.rpm python-tornado-debuginfo-6.3.3-2.oe2403.x86_64.rpm python-tornado-debugsource-6.3.3-2.oe2403.x86_64.rpm python-tornado-help-6.3.3-2.oe2403.x86_64.rpm python3-tornado-6.3.3-2.oe2403.x86_64.rpm python-tornado-debuginfo-6.1-3.oe2203sp4.x86_64.rpm python-tornado-debugsource-6.1-3.oe2203sp4.x86_64.rpm python-tornado-help-6.1-3.oe2203sp4.x86_64.rpm python3-tornado-6.1-3.oe2203sp4.x86_64.rpm python-tornado-debuginfo-6.1-3.oe2203sp3.x86_64.rpm python-tornado-debugsource-6.1-3.oe2203sp3.x86_64.rpm python-tornado-help-6.1-3.oe2203sp3.x86_64.rpm python3-tornado-6.1-3.oe2203sp3.x86_64.rpm python-tornado-debuginfo-5.0.2-9.oe2003sp4.x86_64.rpm python-tornado-debugsource-5.0.2-9.oe2003sp4.x86_64.rpm python2-tornado-5.0.2-9.oe2003sp4.x86_64.rpm python3-tornado-5.0.2-9.oe2003sp4.x86_64.rpm python-tornado-6.1-3.oe2203sp1.src.rpm python-tornado-6.3.3-2.oe2403.src.rpm python-tornado-6.1-3.oe2203sp4.src.rpm python-tornado-6.1-3.oe2203sp3.src.rpm python-tornado-5.0.2-9.oe2003sp4.src.rpm Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue. 2024-12-06 CVE-2024-52804 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-tornado security update 2024-12-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2509