-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 29 May 2025 04:49:07 +0200
Source: python-tornado
Architecture: source
Version: 6.1.0-1+deb11u2
Distribution: bullseye-security
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Daniel Leidert <dleidert@debian.org>
Closes: 1105886
Changes:
python-tornado (6.1.0-1+deb11u2) bullseye-security; urgency=medium
.
* Non-maintainer upload by the Debian LTS team.
* d/patches/CVE-2025-47287.patch: Add patch to fix CVE-2025-47287.
- When Tornado's 'multipart/form-data' parser encounters certain errors,
it logs a warning but continues trying to parse the remainder of the
data. This allows remote attackers to generate an extremely high volume
of logs, constituting a DoS attack. This DoS is compounded by the fact
that the logging subsystem is synchronous (closes: #1105886).
Checksums-Sha1:
282dacfe7b09ea851189faf69cd383e10a7f7297 2559 python-tornado_6.1.0-1+deb11u2.dsc
c23c617c7a0205e465bebad5b8cdf289ae8402a2 513910 python-tornado_6.1.0.orig.tar.gz
31796b8ce80f82b275beb4853a1570db375f499d 15128 python-tornado_6.1.0-1+deb11u2.debian.tar.xz
d294bbf012dd93335d0a04ce7c14dbdd2cc619c6 10406 python-tornado_6.1.0-1+deb11u2_amd64.buildinfo
Checksums-Sha256:
6675398110211d10cf6f3208fad3ba2e6610bd278389a9e0c148e9d89e154564 2559 python-tornado_6.1.0-1+deb11u2.dsc
53a4300b786998c516fcacb76a00db6200829bf1d9b8d57e3c150bfd262e2bc8 513910 python-tornado_6.1.0.orig.tar.gz
89e3dd81aa505ea4cfbe29ee00bc9b901f39f2fda8797a43db2fc33eae7146f3 15128 python-tornado_6.1.0-1+deb11u2.debian.tar.xz
68853ab8bedf33c4ec25597aee8603c308aa8b8b8fd6729d79bf55828f45cbc3 10406 python-tornado_6.1.0-1+deb11u2_amd64.buildinfo
Files:
a943af5d21588e7df5c0d7db7e60272e 2559 web optional python-tornado_6.1.0-1+deb11u2.dsc
2d94363f8a3dcf14dd77a796e19b0386 513910 web optional python-tornado_6.1.0.orig.tar.gz
e04581e9d250011c63f4a7c91ba691f8 15128 web optional python-tornado_6.1.0-1+deb11u2.debian.tar.xz
f2aa61258f33f686c4b6e8ed2aacd6ac 10406 web optional python-tornado_6.1.0-1+deb11u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmg3zcQACgkQS80FZ8KW
0F0AvBAA2kRGOrU0NmxSvzJ9MPfAJjs2B33+UzaRL3zYdJX7YScsuC9ILhTsJWNS
IjDIdVKi8L5U0JadU7tC8BVkDNJTmX/7qm5FIm3IDPuV65XjHUfKzVE95IVRDd9S
+plsxxkguTj6Iuj8MEk0hEJI0Y2P9gLew2JLN4SnCDZr2UiCpPQZWd0mBxpZbQ7q
Xph+t8hwoyx6qWB84LfX+gOZ0H4GOT+90Wjqv5CS3/RtpSigafvOgySjVubQxLjO
6MaoG5FFeFLL56QiAm5knO7Mw9W0IF4Zu9J6nZgE7PC0EmABT9Ehck58dAfYhqeo
1R0zaKU9alDUH+bvrKxuVmVqzVqcqmMzWdDWj9B5XV6wDkM9sPtfXbrE0mqM2bi9
zp1age38Wh3nLEuaqRttxY9YM/QYO0xYuTbl874x9gZgjcNCIe7LO4PMZlmULmEy
yuLpOxpajdRs/ceUsG2v7xHISAHF7ma9lBBpT2vyIaL3zuBRuMfIV0BK4joLzMJ5
i7RvXi/T169I+m7IhMu1G8dMwdFqtO26smjG0zEG7880lYtVusKjFfXSM3oYEuJh
wrJDmbmIB9hO2ckUIr8HXIAzhNwxzFOiaikIMKiyrn6ObAHv7a2Y5fDDdW7ps2N2
liZyvua6AUc3z8c5sfLpQBiqyKPCLayPlULTxADEnf61KmO1G3g=
=qBSS
-----END PGP SIGNATURE-----
Attachment:
pgpKZoMiPGfOe.pgp
Description: PGP signature