Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2014-9720 · ADVISORY
• tornadoweb/tornado commit 1c36307 · WEB
• bugzilla.novell.com/show_bug.cgi · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• pypa/advisory-database · WEB
• tornadoweb/tornado · PACKAGE
• openwall.com/lists/oss-security/2015/05/19/4 · WEB
• tornadoweb.org/en/stable/releases/v3.2.2.html · WEB
• GitHub Advisory GHSA-8vpw-mgpf-mpvv · ADVISORY

tornado のその他の脆弱性

• CVE-2026-116578低 2.1Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place reg…
• CVE-2026-116577中 5.3Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line fold…
• CVE-2026-115927中 5.3Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by…
• CVE-2026-103263中 5.9Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without…
• CVE-2026-103262高 7.5Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to …