drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Cross-Site Request Forgery in python-tornado
Name: |
Cross-Site Request Forgery in python-tornado |
|
ID: |
FEDORA-2016-a3618d9ef6 |
|
Distribution: |
Fedora |
|
Plattformen: |
Fedora 24 |
|
Datum: |
Di, 13. Dezember 2016, 09:37 |
|
Referenzen: |
https://bugzilla.redhat.com/show_bug.cgi?id=1399570 |
|
Applikationen: |
Tornado |
|
Originalnachricht |
Name : python-tornado Product : Fedora 24 Version : 4.4.2 Release : 1.fc24 URL : http://www.tornadoweb.org Summary : Scalable, non-blocking web server and tools Description : Tornado is an open source version of the scalable, non-blocking web server and tools.
The framework is distinct from most mainstream web server frameworks (and certainly most Python frameworks) because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle thousands of simultaneous standing connections, which means it is ideal for real-time web services.
------------------------------------------------------------------------------- - Update Information:
Update to 4.4.2 Security fixes * A difference in cookie parsing between Tornado and web browsers (especially when combined with Google Analytics) could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack. Backwards-compatibility notes * Cookies containing certain special characters (in particular semicolon and square brackets) are now parsed differently. * If the cookie header contains a combination of valid and invalid cookies, the valid ones will be returned (older versions of Tornado would reject the entire header for a single invalid cookie). See also http://tornado.readthedocs.io/en/stable/releases/v4.4.0.html ------------------------------------------------------------------------------- - References:
[ 1 ] Bug #1399570 - python-tornado: XSRF protection bypass via cookie parsing differences https://bugzilla.redhat.com/show_bug.cgi?id=1399570 ------------------------------------------------------------------------------- -
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade python-tornado' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ------------------------------------------------------------------------------- - _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
|
|
|
|