python-tornado-6.5.5-1.el9_7.1
エラータID: AXSA:2026-556:01
リリース日:
2026/05/07 Thursday - 15:16
題名:
python-tornado-6.5.5-1.el9_7.1
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- tornado-python には、リソースの制限を実施していない問題が
あるため、リモートの攻撃者により、サービス拒否攻撃 (リソース枯渇)
を可能とする脆弱性が存在します。(CVE-2026-31958)
- Tornado の .RequestHandler.set_cookie() メソッドには、引数
として渡された値の検証が不十分である問題があるため、リモートの
攻撃者により、情報の漏洩、およびデータ破壊を可能とする脆弱性が
存在します。(CVE-2026-35536)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-31958
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
CVE-2026-35536
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
追加情報:
N/A
ダウンロード:
SRPMS
- python-tornado-6.5.5-1.el9_7.1.src.rpm
MD5: f6705cf8d2d7a35b113523bf3756cdd0
SHA-256: e0601a7570aaa512e70cacbd08bb3d1b3576081f078052c7cf2cbdee9d2d358c
Size: 546.33 kB
Asianux Server 9 for x86_64
- python3-tornado-6.5.5-1.el9_7.1.x86_64.rpm
MD5: 2387fe15fa262468b58f1897586ccd22
SHA-256: ff3307bd8ef4ddfbbe5cc437e61df7cf6295fba2e2bafffe058b1b71befc69be
Size: 731.95 kB
English