python-tornado-6.5.5-1.el9
エラータID: AXSA:2026-964:02
リリース日:
2026/06/25 Thursday - 04:51
題名:
python-tornado-6.5.5-1.el9
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- tornado-python には、リソースの制限を実施していない問題がある
ため、リモートの攻撃者により、サービス拒否攻撃 (リソース枯渇) を
可能とする脆弱性が存在します。(CVE-2026-31958)
- Tornado の .RequestHandler.set_cookie() メソッドには、引数
として渡された値の検証が不十分である問題があるため、リモートの
攻撃者により、情報の漏洩、およびデータ破壊を可能とする脆弱性が
存在します。(CVE-2026-35536)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-31958
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
CVE-2026-35536
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
追加情報:
N/A
ダウンロード:
SRPMS
- python-tornado-6.5.5-1.el9.src.rpm
MD5: f804ddcd32411ec31f0528bc6e147a69
SHA-256: 5bc1c79e60b6b3c97c7f8ebcbf09e5ee84ab08bfd02e7b508ac0f0fdd4b5e060
Size: 546.06 kB
Asianux Server 9 for x86_64
- python3-tornado-6.5.5-1.el9.x86_64.rpm
MD5: 8389fe01f1b255219f18d613bbab391b
SHA-256: 043a2d3c8e3bd298448c6e677bba83e17e10884f48f2f0237c2e6c978911007c
Size: 731.73 kB
English