Vulnerability feed

Executive summary

Canonical's Ubuntu Security Team published notice USN-8952-1 covering the Tornado Python web framework package (python-tornado) on supported Ubuntu releases. The advisory says the flaws could let an attacker crash the service or expose sensitive information when it receives specially crafted network traffic, and it recommends a standard system update to the fixed package versions.

Technical summary

The advisory describes flaws in how Tornado handles certain HTTP requests and network inputs, which can lead to denial of service, information exposure, or bypass of access controls. The advisory does not state the specific vulnerability classes, the attack vector details beyond specially crafted network traffic, or whether authentication is required. Fixed package versions are listed per release: python3-tornado 6.5.5-5ubuntu1.1 on 26.10, 6.5.4-0.1ubuntu0.2 on 26.04 LTS, 6.4.0-1ubuntu0.6 on 24.04 LTS, 6.1.0-3ubuntu0.1~esm6 on 22.04 LTS, 6.0.3+really5.1.1-3ubuntu0.1~esm7 on 20.04 LTS, 4.5.3-1ubuntu0.2+esm4 on 18.04 LTS, and 4.2.1-1ubuntu3.1+esm4 on 16.04 LTS. For 22.04, 20.04, 18.04, and 16.04, fixes are available through Ubuntu Pro ESM Apps or the Legacy Support add-on, and a community fix might appear later. No workarounds or detection guidance are stated, and the advisory does not state CVSS scores or exploitation in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from ubuntu.com/security/notices/USN-8952-1

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Affects

CanonicalTornadoCanonical Ubuntu LinuxCanonical python-tornadoTornado