python-tornado vulnerabilities (Debian)
27 vulnerabilities.
-
python-tornadoDebian Tornado: Open redirect in RedirectHandler via protocol-relative URLs 2.1 Low -
python-tornadoDebian Tornado: Quadratic CPU usage when parsing HTTP headers with line folding 5.3 Medium -
python-tornadoDebian Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks 5.3 Medium -
python-tornadoDebian Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink 8.2 High -
python-tornadoDebian Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient 8.7 High -
python-tornadoDebian Tornado before 6.5.9 Denial of Service via Query String 6.9 Medium -
python-tornadoDebian Tornado before 6.5.8 Memory Amplification DoS via multipart 8.7 High -
python-tornadoDebian Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs 6.3 Medium -
python-tornadoDebian Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop 7.5 High -
python-tornadoDebian Tornado before 6.5.7 Credential Leak via Handle Reuse 8.2 High -
python-tornadoDebian tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 7.5 High -
python-tornadoDebian Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 7.7 High -
python-tornadoDebian Tornado: Out-of-bounds memory access in C extension 5.3 Medium -
python-tornadoDebian Tornado has incomplete validation of cookie attributes 7.2 High -
python-tornadoDebian Tornado has a DoS due to too many multipart parts 8.7 High -
python-tornadoDebian Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters 7.5 High -
python-tornadoDebian Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing 7.5 High -
python-tornadoDebian Tornado vulnerable to Header Injection and XSS via reason argument 5.4 Medium -
python-tornadoDebian Tornado vulnerable to excessive logging caused by malformed multipart form data 7.5 High -
python-tornadoDebian Tornado has HTTP cookie parsing DoS vulnerability 7.5 High -
python-tornadoDebian Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient 6.3 Medium -
python-tornadoDebian Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding 9.0 Critical -
python-tornadoDebian Tornado before 6.3.3 HTTP Request Smuggling via Content-Length 9.0 Critical -
python-tornadoDebian Open redirect in Tornado 6.1 Medium -
python-tornadoDebian Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) 6.5 Medium -
python-tornadoDebian Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x,... 4.3 Medium -
python-tornadoDebian Tornado CRLF injection vulnerability 5.0 Medium