Fedora: python-tornado 4.4.2 moderate: XSRF Cookie Parsing Update

Tornado is an open source version of the scalable, non-blocking web

server and tools.

The framework is distinct from most mainstream web server frameworks

(and certainly most Python frameworks) because it is non-blocking and

reasonably fast. Because it is non-blocking and uses epoll, it can

handle thousands of simultaneous standing connections, which means it is

ideal for real-time web services.

Update to 4.4.2: Security fixes * A difference in cookie parsing between Tornado and web browsers (especially when combined with Google Analytics) could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack. Backwards-compatibility notes * Cookies containing certain special characters (in particular semicolon and square brackets) are now parsed differently. * If the cookie header contains a combination of valid and invalid cookies, the valid ones will be returned (older versions of Tornado would reject the entire header for a single invalid cookie).