PT-2016-7977 · Facebook · Tornado

Published 2016-12-11 · Updated 2016-12-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Tornado (affected versions not specified)

Description A difference in cookie parsing between Tornado and web browsers, especially when combined with Google Analytics, could allow an attacker to set arbitrary cookies and bypass XSRF protection. The issue is related to the cookie parser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2016-0418

Affected Products

Tornado

References · 4

• https://osv.dev/vulnerability/MGASA-2016-0418 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/PJEFGW4II3TYTO7TICVK47WENL2URP46 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0418.html · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=19859 · Note