Lucene search

K
osvGoogleOSV:DLA-475-1
HistoryMay 15, 2016 - 12:00 a.m.

python-tornado - security update

2016-05-1500:00:00
Google
osv.dev
7

0.005 Low

EPSS

Percentile

76.1%

It was discovered that python-tornado, a Python web framework and
asynchronous networking library, was susceptible for the BREACH attack.
The XSRF token is now encoded with a random mask on each request. This
makes it safe to include in compressed pages without being vulnerable.

For Debian 7 Wheezy, these problems have been fixed in version
2.3-2+deb7u1.

We recommend that you upgrade your python-tornado packages.

CPENameOperatorVersion
python-tornadoeq2.3-2