This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2024-58384 →

DEBIAN-CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in r...

Original description

The description as published by the source.

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-tornado

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-tornado

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1"}]}]

Debian:14 python-tornado

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1"}]}]

References

advisory security-tracker.debian.org