Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Fedora 22 Python-Tornado Security Update - XSRF Mitigation for BREACH

fedora
Calendar Grey June 9, 2015
Dist Fedora Esm H88
The latest python-tornado update for Fedora 22 includes enhancements to the XSRF token which mitigates the risk of BREACH attacks while fortifying overall security protocols.
Security fixes The XSRF token is now encoded with a random mask on each request

Summary

Tornado is an open source version of the scalable, non-blocking web

server and tools.

The framework is distinct from most mainstream web server frameworks

(and certainly most Python frameworks) because it is non-blocking and

reasonably fast. Because it is non-blocking and uses epoll, it can

handle thousands of simultaneous standing connections, which means it is

ideal for real-time web services.

Update Information:

Security fixes

The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Backwards-compatibility notes

If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers.

Topics%20covered

Topics Covered

security advisory Fedora security fix BREACH python-tornado XSRF token

Change Log

* Tue May 19 2015 Thomas Spura - 3.2.2-1 - Update to 3.2.2 to fix breack attack cve (#1222816,#1222819)

References


[ 1 ] Bug #1222816 - CVE-2014-9720 python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) https://bugzilla.redhat.com/show_bug.cgi?id=1222816

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update python-tornado' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: python-tornado
Product: Fedora 22
Version: 3.2.2
Release: 1.fc22
URL: https://www.tornadoweb.org/en/stable/
Summary: Scalable, non-blocking web server and tools

Topics%20covered

Topics Covered

security advisory Fedora security fix BREACH python-tornado XSRF token

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here