| Package | Affected versions | Patched versions |
|---|---|---|
| tornado | < 6.5.6 | 6.5.6 |
Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.
The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.
This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free