Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2024-14029 →
DEBIAN-CVE-2024-14029
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
python-tornado
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
python-tornado
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1"}]}]
Debian:14
python-tornado
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1"}]}]
Références
- advisory security-tracker.debian.org