CVE-2024-52804
published 2024-11-22CVE-2024-52804: Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.05%
61.0th percentile
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-tornado | < python-tornado 6.2.0-3+deb12u1 (bookworm) | python-tornado 6.2.0-3+deb12u1 (bookworm) |
| tornadoweb | tornado | < 6.4.2 | 6.4.2 |
| tornadoweb | tornado | >= 0 < 6.4.2 | 6.4.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tornado vulnerabilities
vendor_ubuntu·2024-12-11·CVSS 6.1
CVE-2024-52804 [MEDIUM] Tornado vulnerabilities
Title: Tornado vulnerabilities
Summary: Several security issues were fixed in Tornado.
It was discovered that Tornado incorrectly handled a certain redirect.
A remote attacker could possibly use this issue to redirect a user to an
arbitrary web site and conduct a phishing attack by having the user access
a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously
addressed in USN-6159-1. (CVE-2023-28370)
It was discovered that Tornado inefficiently handled requests when parsing
cookies. An attacker could possibly use this issue to increase resource
utilization leading to a denial of service. (CVE-2024-52804)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-tornado: Tornado has HTTP cookie parsing DoS vulnerability
vendor_redhat·2024-11-22·CVSS 7.5
CVE-2024-52804 [HIGH] CWE-1333 python-tornado: Tornado has HTTP cookie parsing DoS vulnerability
python-tornado: Tornado has HTTP cookie parsing DoS vulnerability
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
A flaw was found in Tornado's HTTP cookie parsing algorithm. This vulnerability allows excessive CPU consumption via maliciously crafted cookie headers due to Quadratic complexity, potentially blocking the processing of other requests and leading to the loss of availability of the system.
Mitigation: Mitigation for this issue is eith
Debian
CVE-2024-52804: python-tornado - Tornado is a Python web framework and asynchronous networking library. The algor...
vendor_debian·2024·CVSS 7.5
CVE-2024-52804 [HIGH] CVE-2024-52804: python-tornado - Tornado is a Python web framework and asynchronous networking library. The algor...
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
Scope: local
bookworm: resolved (fixed in 6.2.0-3+deb12u1)
bullseye: resolved (fixed in 6.1.0-1+deb11u1)
forky: resolved (fixed in 6.4.2-1)
sid: resolved (fixed in 6.4.2-1)
trixie: resolved (fixed in 6.4.2-1)
OSV
python-tornado vulnerabilities
osv·2024-12-11·CVSS 6.1
CVE-2023-28370 [MEDIUM] python-tornado vulnerabilities
python-tornado vulnerabilities
It was discovered that Tornado incorrectly handled a certain redirect.
A remote attacker could possibly use this issue to redirect a user to an
arbitrary web site and conduct a phishing attack by having the user access
a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously
addressed in USN-6159-1. (CVE-2023-28370)
It was discovered that Tornado inefficiently handled requests when parsing
cookies. An attacker could possibly use this issue to increase resource
utilization leading to a denial of service. (CVE-2024-52804)
OSV
CVE-2024-52804: Tornado is a Python web framework and asynchronous networking library
osv·2024-11-22·CVSS 7.5
CVE-2024-52804 [HIGH] CVE-2024-52804: Tornado is a Python web framework and asynchronous networking library
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
OSV
Tornado has an HTTP cookie parsing DoS vulnerability
osv·2024-11-22·CVSS 7.5
CVE-2024-52804 [HIGH] Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
GHSA
Tornado has an HTTP cookie parsing DoS vulnerability
ghsa·2024-11-22·CVSS 7.5
CVE-2024-52804 [HIGH] CWE-400 Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-22
Published