GHSA-8w49-h785-mj3c

Source

https://github.com/advisories/GHSA-8w49-h785-mj3c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8w49-h785-mj3c/GHSA-8w49-h785-mj3c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8w49-h785-mj3c

Aliases

CVE-2024-52804

Related

Published

2024-11-22T20:26:41Z

Modified

2024-11-22T22:35:53.364850Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Tornado has an HTTP cookie parsing DoS vulnerability

Details

The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.

See also CVE-2024-7592 for a similar vulnerability in cpython.

Database specific

{
    "nvd_published_at": "2024-11-22T16:15:34Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-22T20:26:41Z"
}

References

Affected packages

PyPI / tornado

Package

Name: tornado; View open source insights on deps.dev
Purl: pkg:pypi/tornado

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.4.2

Affected versions

0.*

0.2

1.*

1.0

1.1

1.1.1

1.2

1.2.1

2.*

2.0

2.1

2.1.1

2.2

2.2.1

2.3

2.4

2.4.1

3.*

3.0

3.0.1

3.0.2

3.1

3.1.1

3.2

3.2.1

3.2.2

4.*

4.0

4.0.1

4.0.2

4.1b2

4.1

4.2b1

4.2

4.2.1

4.3b1

4.3b2

4.3

4.4b1

4.4

4.4.1

4.4.2

4.4.3

4.5b1

4.5b2

4.5

4.5.1

4.5.2

4.5.3

5.*

5.0a1

5.0b1

5.0

5.0.1

5.0.2

5.1b1

5.1

5.1.1

6.*

6.0a1

6.0b1

6.0

6.0.1

6.0.2

6.0.3

6.0.4

6.1b1

6.1b2

6.1

6.2b1

6.2b2

6.2

6.3b1

6.3

6.3.1

6.3.2

6.3.3

6.4b1

6.4

6.4.1

Database specific

{
    "last_known_affected_version_range": "<= 6.4.1"
}