Every CVE Search/ Get API key

CVE-2014-9720

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

6.5 MediumFix available

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.51%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
CVE-2014-9720
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
CVE List No score

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
CVE-2014-9720
Updated
2026-11-02
EUVDEUVD-2020-0222 No score

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
EUVD-2020-0222
Updated
2026-11-03
GitHub AdvisoriesGHSA-8vpw-mgpf-mpvv 7.1

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
GHSA-8vpw-mgpf-mpvv
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
OSV 6.5

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
CVE-2014-9720
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9720 6.5

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
DEBIAN-CVE-2014-9720
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-8vpw-mgpf-mpvv 7.1

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
GHSA-8vpw-mgpf-mpvv
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
OSVMGASA-2015-0251 No score

Updated python-tornado package fixes security vulnerability

Security fixes (CVE-2014-9720) The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Record
MGASA-2015-0251
Updated
2026-11-02
OSVPYSEC-2020-213 No score

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Record
PYSEC-2020-213
Updated
2026-11-02
OSVSUSE-SU-2016:1195-1 No score

Security update for python-tornado

The python-tornado module was updated to version 4.2.1, which brings several fixes, enhancements and new features.

The following security issues have been fixed:

  • A path traversal vulnerability in StaticFileHandler, in which files whose names started with the static_path directory but were not actually in that directory could be accessed.
  • The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy). (bsc#930362, CVE-2014-9720)
  • The signed-value format used by RequestHandler.{g,s}et_secure_cookie changed to be more secure. (bsc#930361)

The following enhancements have been implemented:

  • SSLIOStream.connect and IOStream.start_tls now validate certificates by default.
  • Certificate validation will now use the system CA root certificates.
  • The default SSL configuration has become stricter, using ssl.create_default_context where available on the client side.
  • The deprecated classes in the tornado.auth module, GoogleMixin, FacebookMixin and FriendFeedMixin have been removed.
  • New modules have been added: tornado.locks and tornado.queues.
  • The tornado.websocket module now supports compression via the 'permessage-deflate' extension.
  • Tornado now depends on the backports.ssl_match_hostname when running on Python 2.

For a comprehensive list of changes, please refer to the release notes:

Record
SUSE-SU-2016:1195-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tornado
PyPI
 before 3.2.2
3.2.2
python-tornado
Debian:12
 before 3.2.2-1
3.2.2-1
python-tornado
Debian:13
 before 3.2.2-1
3.2.2-1
python-tornado
Debian:14
 before 3.2.2-1
3.2.2-1
python-tornado
Debian:6.0
 before 1.0.1-1+deb6u1, plus listed versions
1.0.1-1
1.0.1-1+deb6u1
python-tornado
Debian:7
 before 2.3-2+deb7u1, plus listed versions
2.3-2
2.3-2+deb7u1
tornado
PyPI
 before 3.2.2, plus listed versions
0.21.01.11.1.11.2
Show 16 moreShow less
1.2.12.02.12.1.12.22.2.12.32.42.4.13.03.0.13.0.23.13.1.13.23.2.1
3.2.2
python-tornado
Mageia:4
 before 3.1-4.1.mga4
3.1-4.1.mga4
tornado
PyPI
 before 3.2.2, plus listed versions
0.21.01.11.1.11.2
Show 31 moreShow less
1.2.12.02.12.1.12.22.2.12.32.42.4.13.03.0.13.0.23.13.1.13.23.2.1v3.2.1v3.2.0v3.2.0b2v3.2.0b1v3.1.0v3.0.1v3.0.0v2.1.1v2.3.0v2.2.0v2.1.0v2.0.0v1.2.0v1.1.0v1.0.0
3.2.2
python-backports.ssl_match_hostname
SUSE:Linux Enterprise Desktop 12
 before 3.4.0.2-15.1
3.4.0.2-15.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
python-tornado
SUSE:Linux Enterprise Desktop 12
 before 4.2.1-11.1
4.2.1-11.1
python-backports.ssl_match_hostname
SUSE:Linux Enterprise Desktop 12 SP1
 before 3.4.0.2-15.1
3.4.0.2-15.1
python-tornado
SUSE:Linux Enterprise Desktop 12 SP1
 before 4.2.1-11.1
4.2.1-11.1
python-backports.ssl_match_hostname
SUSE:Linux Enterprise Workstation Extension 12
 before 3.4.0.2-15.1
3.4.0.2-15.1
python-tornado
SUSE:Linux Enterprise Workstation Extension 12
 before 4.2.1-11.1
4.2.1-11.1
python-backports.ssl_match_hostname
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 3.4.0.2-15.1
3.4.0.2-15.1
python-tornado
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 4.2.1-11.1
4.2.1-11.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9720 is a medium vulnerability (CVSS 6.5) in Tornadoweb Tornado, published July 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in tornado 3.2.2.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open