Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2024-58384 →
DEBIAN-CVE-2024-58384
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in r...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
python-tornado
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
python-tornado
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1"}]}]
Debian:14
python-tornado
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1"}]}]
Références
- advisory security-tracker.debian.org