Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Fedora 21: FEDORA-2015-8606 Moderate: Python Tornado XSRF Protection

fedora
Calendar Grey June 10, 2015
Scroller Fedora
Ubuntu Patch Alert UBUNTU-2023-4701 introduces essential CSRF token enhancements for Flask web framework security.
Security fixes The XSRF token is now encoded with a random mask on each request

Summary

Tornado is an open source version of the scalable, non-blocking web

server and tools.

The framework is distinct from most mainstream web server frameworks

(and certainly most Python frameworks) because it is non-blocking and

reasonably fast. Because it is non-blocking and uses epoll, it can

handle thousands of simultaneous standing connections, which means it is

ideal for real-time web services.

Update Information:

Security fixes

The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Backwards-compatibility notes

If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers.

Topics%20covered

Topics Covered

security advisory software update Fedora security fix Python BREACH attack XSRF protection

Change Log

* Tue May 19 2015 Thomas Spura - 3.2.2-1 - Update to 3.2.2 to fix breack attack cve (#1222816,#1222819)

References


[ 1 ] Bug #1222816 - CVE-2014-9720 python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) https://bugzilla.redhat.com/show_bug.cgi?id=1222816

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update python-tornado' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: python-tornado
Product: Fedora 21
Version: 3.2.2
Release: 1.fc21
URL: https://www.tornadoweb.org/en/stable/
Summary: Scalable, non-blocking web server and tools

Topics%20covered

Topics Covered

security advisory software update Fedora security fix Python BREACH attack XSRF protection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.