GHSA-8w49-h785-mj3c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-8w49-h785-mj3c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8w49-h785-mj3c/GHSA-8w49-h785-mj3c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-8w49-h785-mj3c
- Aliases
-
- CVE-2024-52804
- Published
- 2024-11-22T20:26:41Z
- Modified
- 2024-11-22T22:35:53.364850Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Tornado has an HTTP cookie parsing DoS vulnerability
- Details
-
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
- References
Affected packages
PyPI / tornado
Package
- Name
- tornado
- View open source insights on deps.dev
- Purl
- pkg:pypi/tornado
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed6.4.2
Affected versions
0.*
0.2
1.*
1.0
1.1
1.1.1
1.2
1.2.1
2.*
2.0
2.1
2.1.1
2.2
2.2.1
2.3
2.4
2.4.1
3.*
3.0
3.0.1
3.0.2
3.1
3.1.1
3.2
3.2.1
3.2.2
4.*
4.0
4.0.1
4.0.2
4.1b2
4.1
4.2b1
4.2
4.2.1
4.3b1
4.3b2
4.3
4.4b1
4.4
4.4.1
4.4.2
4.4.3
4.5b1
4.5b2
4.5
4.5.1
4.5.2
4.5.3
5.*
5.0a1
5.0b1
5.0
5.0.1
5.0.2
5.1b1
5.1
5.1.1
6.*
6.0a1
6.0b1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.1b1
6.1b2
6.1
6.2b1
6.2b2
6.2
6.3b1
6.3
6.3.1
6.3.2
6.3.3
6.4b1
6.4
6.4.1