Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4007 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4007-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     January 01, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-tornado     Version        : 6.1.0-1+deb11u1     CVE ID         : CVE-2023-28370 CVE-2024-52804     Debian Bug     : 1036875 1088112

    Tornado is a scalable, non-blocking Python web framework and     asynchronous networking library.

    CVE-2023-28370

        An open redirect vulnerability in Tornado versions 6.3.1 and earlier allows         a remote unauthenticated attacker to redirect a user to an arbitrary web         site and conduct a phishing attack by having the user access a specially         crafted URL.

    CVE-2024-52804

        The algorithm used for parsing HTTP cookies in Tornado versions prior to         6.4.2 sometimes has quadratic complexity, leading to excessive CPU         consumption when parsing maliciously-crafted cookie headers. This         parsing occurs in the event loop thread and may block the processing of         other requests.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.0-1+deb11u1.

    We recommend that you upgrade your python-tornado packages.

    For the detailed security status of python-tornado please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-tornado

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4137-1 advisory.

    - CVE-2024-52804: Fixed a denial of service caused by quadratic performance of cookie parsing     (bsc#1233668)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7150-1 advisory.

    It was discovered that Tornado incorrectly handled a certain redirect. A remote attacker could possibly     use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having the     user access a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 20.04 LTS,     and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously addressed in USN-6159-1. (CVE-2023-28370)

    It was discovered that Tornado inefficiently handled requests when parsing cookies. An attacker could     possibly use this issue to increase resource utilization leading to a denial of service. (CVE-2024-52804)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:10843 advisory.

    Tornado is a Python web framework and asynchronous networking library that provides an open source version     of scalable, non-blocking web server and tools.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:10836 advisory.

    Tornado is a Python web framework and asynchronous networking library that provides an open source version     of scalable, non-blocking web server and tools.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:10590 advisory.

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-10590 advisory.

    [6.4.2-1]
    - Update to 6.4.2       Resolves: RHEL-68663

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:10590 advisory.

    Tornado is a Python web framework and asynchronous networking library that provides an open source version     of scalable, non-blocking web server and tools.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213445	Debian dla-4007 : python-tornado-doc - security update	Nessus	Debian Local Security Checks	medium
212592	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-tornado6 (SUSE-SU-2024:4137-1)	Nessus	SuSE Local Security Checks	high
212409	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Tornado vulnerabilities (USN-7150-1)	Nessus	Ubuntu Local Security Checks	medium
212116	RHEL 9 : python-tornado (RHSA-2024:10843)	Nessus	Red Hat Local Security Checks	high
212084	RHEL 9 : python-tornado (RHSA-2024:10836)	Nessus	Red Hat Local Security Checks	high
212029	AlmaLinux 9 : python-tornado (ALSA-2024:10590)	Nessus	Alma Linux Local Security Checks	high
211996	Oracle Linux 9 : python-tornado (ELSA-2024-10590)	Nessus	Oracle Linux Local Security Checks	high
211988	RHEL 9 : python-tornado (RHSA-2024:10590)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-52804

high

Tenable Plugins

medium

high

medium

high

high

high

high

high