Lucene search
GoogleOSV:PYSEC-2020-213HistoryJan 24, 2020 - 6:15 p.m.
PYSEC-2020-213
2020-01-2418:15:00
Google
osv.dev
18
0.005 Low
EPSS
Percentile
76.1%
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Related
nessus
nessus
Debian DLA-475-1 : python-tornado security update
2016-05-16 00:00:00
SUSE SLED12 Security Update : python-tornado (SUSE-SU-2016:1195-1)
2016-05-04 00:00:00
RHEL 7 : python-tornado (Unpatched Vulnerability)
2024-06-03 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: python-tornado-3.2.2-1.fc21
2015-06-10 19:18:24
[SECURITY] Fedora 22 Update: python-tornado-3.2.2-1.fc22
2015-06-09 15:04:28
nvd
nvd
CVE-2014-9720
2020-01-24 18:15:12
osv
osv
python-tornado - security update
2015-07-22 00:00:00
python-tornado - security update
2016-05-15 00:00:00
Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
2022-05-17 19:57:19
debian
debian
[SECURITY] [DLA 279-1] python-tornado security update
2015-07-22 12:52:54
[SECURITY] [DLA 475-1] python-tornado security update
2016-05-15 19:45:40
github
github
Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
2022-05-17 19:57:19
openvas
openvas
Fedora Update for python-tornado FEDORA-2015-9143
2015-07-07 00:00:00
Debian: Security Advisory (DLA-475-1)
2023-03-08 00:00:00
Mageia: Security Advisory (MGASA-2015-0251)
2022-01-28 00:00:00
mageia
mageia
Updated python-tornado package fixes security vulnerability
2015-07-01 15:40:22
cvelist
cvelist
CVE-2014-9720
2020-01-24 17:03:38
prion
prion
Cross site request forgery (csrf)
2020-01-24 18:15:00
debiancve
debiancve
CVE-2014-9720
2020-01-24 18:15:12
cve
cve
CVE-2014-9720
2020-01-24 18:15:12
ubuntucve
ubuntucve
CVE-2014-9720
2020-01-24 00:00:00