CVE-2023-28370

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.(CVE-2023-28370)

Root has patched CVE-2023-28370 in the tornado package for Root:PyPI. Multiple fixed versions available.

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools.

Security Fix(es):

• python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations (CVE-2023-28370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

TuxCare rebuilt tornado to address 1 CVE. Fixed in 5.1.1.post2+tuxcare.

TuxCare rebuilt tornado to address 1 CVE. Fixed in 6.1.0.post6+tuxcare.

Remote unauthenticated attacker may redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. (CVE-2023-28370)

These are all security issues fixed in the python310-tornado6-6.3.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python3-salt-3006.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-tornado6-6.5.7-2.1 package on the GA media of openSUSE Tumbleweed.

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

This update fixes the following issues:

venv-salt-minion:

• CVE-2023-28370: Tornado: Fix an open redirect issue in the static file handler (bsc#1211741)
• Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)
• Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517)
• Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754)

This update for python-tornado fixes the following issues:

• CVE-2023-28370: Fixed an open redirect issue in the static file handler (bsc#1211741).

This update for python-tornado fixes the following issues:

• CVE-2023-28370: Fixed an open redirect issue in the static file handler (bsc#1211741).

This update fixes the following issues:

python-tornado:

• Security fixes:
  • CVE-2023-28370: Fixed an open redirect issue in the static file handler (bsc#1211741)

kiwi-desc-saltboot:

• Update to version 0.1.1687520761.cefb248
  • Add osimage cert package to bootstrap for SUSE Linux Enterprise 12 images (bsc#1204089)

prometheus-blackbox_exporter:

• Use obscpio for go modules service
• Set version number
• Set build date from SOURCE_DATE_EPOCH
• Update to 0.24.0 (bsc#1212279, jsc#PED-4556)
  • Requires go1.19
• Avoid empty validation script
• Add rc symlink for backwards compatibility

spacecmd:

• Version 4.3.22-1
  • Bypass traditional systems check on older SUMA instances (bsc#1208612)

This update for salt fixes the following issues:

Security fixes:

• CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations (bsc#1211741)

Bug fixes:

• Prevent error loading 'known_hosts' when '$HOME' is not set. (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module. (bsc#1211591)

This update fixes the following issues:

venv-salt-minion:

• Security fixes:
  • CVE-2023-28370: Tornado: Fix an open redirect in StaticFileHandler (bsc#1211741)
• Bug fixes:
  • Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994)
  • Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)
  • Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517)
  • Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754)

This update for salt fixes the following issues:

Security fixes:

• CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations (bsc#1211741)

Bug fixes:

• Prevent error loading 'known_hosts' when '$HOME' is not set (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)

This update fixes the following issues:

venv-salt-minion:

• CVE-2023-28370: Tornado: Fix an open redirect issue in the static file handler (bsc#1211741)
• Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)
• Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517)
• Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754)

This update for salt fixes the following issues:

Security fixes:

• CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations (bsc#1211741)

Bug fixes:

• Prevent error loading 'known_hosts' when '$HOME' is not set (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)

This update fixes the following issues:

venv-salt-minion:

• Security fixes:
  • CVE-2023-28370: Tornado: Fix an open redirect in StaticFileHandler (bsc#1211741)
• Bug fixes:
  • Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994)
  • Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)
  • Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517)

This update for salt fixes the following issues:

Security fixes:

• CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations (bsc#1211741)

Bug fixes:

• Prevent error loading 'known_hosts' when '$HOME' is not set (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)

This update fixes the following issues:

python-tornado:

• Security fixes:
  • CVE-2023-28370: Fixed an open redirect issue in the static file handler (bsc#1211741)

prometheus-blackbox_exporter:

• Use obscpio for go modules service
• Set version number
• Set build date from SOURCE_DATE_EPOCH
• Update to 0.24.0 (bsc#1212279, jsc#PED-4556)
  • Requires go1.19
• Avoid empty validation script
• Add rc symlink for backwards compatibility

spacecmd:

• Version 4.3.22-1
  • Bypass traditional systems check on older SUMA instances (bsc#1208612)

This update for salt fixes the following issues:

Security fixes:

• CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations (bsc#1211741)

Bug fixes:

• Prevent error loading 'known_hosts' when '$HOME' is not set (bsc#1210994)
• Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)

It was discovered that Tornado incorrectly handled certain redirect. An remote attacker could possibly use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

It was discovered that Tornado incorrectly handled a certain redirect. A remote attacker could possibly use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having the user access a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously addressed in USN-6159-1. (CVE-2023-28370)

It was discovered that Tornado inefficiently handled requests when parsing cookies. An attacker could possibly use this issue to increase resource utilization leading to a denial of service. (CVE-2024-52804)