PT-2016-7977 · Facebook · Tornado

Publicado 2016-12-11 · Atualizado 2016-12-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Tornado (affected versions not specified)

Description A difference in cookie parsing between Tornado and web browsers, especially when combined with Google Analytics, could allow an attacker to set arbitrary cookies and bypass XSRF protection. The issue is related to the cookie parser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

MGASA-2016-0418

Produtos afetados

Tornado

Referências · 4

• https://osv.dev/vulnerability/MGASA-2016-0418 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/PJEFGW4II3TYTO7TICVK47WENL2URP46 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2016-0418.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=19859 · Nota