MGASA-2016-0418
Updated python-tornado package fixes security vulnerability
A difference in cookie parsing between Tornado and web browsers (especially when combined with Google Analytics) could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack.
What each source reports
OSV No score
Updated python-tornado package fixes security vulnerability
A difference in cookie parsing between Tornado and web browsers (especially when combined with Google Analytics) could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack.
- Record
MGASA-2016-0418- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-tornadoMageia:5 |
before 3.2.2-4.2.mga5 | 3.2.2-4.2.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2016-0418 is a vulnerability with no CVSS score yet in python-tornado, published December 11, 2016. No source lists public exploit code. Fixed in python-tornado 3.2.2-4.2.mga5.