Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) (CVE-2014-9720)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

It was discovered that python-tornado, a Python web framework and asynchronous networking library, was susceptible for the BREACH attack. The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable.

For Debian 7 'Wheezy', these problems have been fixed in version 2.3-2+deb7u1.

We recommend that you upgrade your python-tornado packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The python-tornado module was updated to version 4.2.1, which brings several fixes, enhancements and new features.

The following security issues have been fixed :

  - A path traversal vulnerability in StaticFileHandler, in     which files whose names started with the static_path     directory but were not actually in that directory could     be accessed.

  - The XSRF token is now encoded with a random mask on each     request. This makes it safe to include in compressed     pages without being vulnerable to the BREACH attack.
    This applies to most applications that use both the     xsrf_cookies and gzip options (or have gzip applied by a     proxy). (bsc#930362, CVE-2014-9720)

  - The signed-value format used by     RequestHandler.{g,s}et_secure_cookie changed to be more     secure. (bsc#930361)

The following enhancements have been implemented :

  - SSLIOStream.connect and IOStream.start_tls now validate     certificates by default.

  - Certificate validation will now use the system CA root     certificates.

  - The default SSL configuration has become stricter, using     ssl.create_default_context where available on the client     side.

  - The deprecated classes in the tornado.auth module,     GoogleMixin, FacebookMixin and FriendFeedMixin have been     removed.

  - New modules have been added: tornado.locks and     tornado.queues.

  - The tornado.websocket module now supports compression     via the 'permessage-deflate' extension.

  - Tornado now depends on the backports.ssl_match_hostname     when running on Python 2.

For a comprehensive list of changes, please refer to the release notes :

- http://www.tornadoweb.org/en/stable/releases/v4.2.0.html

- http://www.tornadoweb.org/en/stable/releases/v4.1.0.html

- http://www.tornadoweb.org/en/stable/releases/v4.0.0.html

- http://www.tornadoweb.org/en/stable/releases/v3.2.0.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

python-tornado was updates to fix one security issue.

The following vulnerability was fixed :

  - CVE-2014-9720: XSRF cookie allowed side-channel attack     against TLS (BREACH)

A vulnerability was discovered in python-tornado, a Python scalable, non- blocking web server.

CVE-2014-9720

CSRF cookie allows side-channel attack against TLS (BREACH)

Security Fix

The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. For the oldoldstable distribution (squeeze), this problem has been fixed in version 1.0.1-1+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes

The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Backwards-compatibility notes

If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199117	RHEL 7 : python-tornado (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
91137	Debian DLA-475-1 : python-tornado security update	Nessus	Debian Local Security Checks	medium
90883	SUSE SLED12 Security Update : python-tornado (SUSE-SU-2016:1195-1)	Nessus	SuSE Local Security Checks	medium
86890	openSUSE Security Update : python-tornado (openSUSE-2015-741)	Nessus	SuSE Local Security Checks	medium
84932	Debian DLA-279-1 : python-tornado security update	Nessus	Debian Local Security Checks	medium
84096	Fedora 21 : python-tornado-3.2.2-1.fc21 (2015-8606)	Nessus	Fedora Local Security Checks	medium
84066	Fedora 22 : python-tornado-3.2.2-1.fc22 (2015-9143)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-9720

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium