PT-2020-7788 · Tornado+1 · Tornado+1

Published 2015-07-01 · Updated 2022-05-17 · CVE-2014-9720

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Tornado versions prior to 3.2.2

Description: The issue allows remote attackers to conduct a BREACH attack and determine a fixed CSRF token via a series of crafted requests, as Tornado sends arbitrary responses that contain this token and may be sent with HTTP compression.

Recommendations: For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2014-9720

DLA-279-1

DLA-475-1

GHSA-8VPW-MGPF-MPVV

MGASA-2015-0251

PYSEC-2020-213

SUSE-SU-2016:1195-1

SUSE-SU-2016_1195-1

Affected Products

Suse

Tornado

References · 24

• https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308 · Patch
• https://osv.dev/vulnerability/MGASA-2015-0251 · Vendor Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=930362 · Patch
• https://osv.dev/vulnerability/PYSEC-2020-213 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/05/19/4 · Patch
• https://advisories.mageia.org/MGASA-2015-0251.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-9720 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1195-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9720 · Security Note
• http://tornadoweb.org/en/stable/releases/v3.2.2.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1222816 · Patch
• https://osv.dev/vulnerability/GHSA-8vpw-mgpf-mpvv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9720 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9720 · Vendor Advisory
• https://github.com/tornadoweb/tornado · Note