Homepage

tornado@6.5.8

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

  • latest version

    6.5.10

  • latest non vulnerable version

    6.6b1

  • first published

    16 years ago

  • latest version published

    23 days ago

  • licenses detected

  • View tornado package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the tornado package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Symlink Attack

    tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

    Affected versions of this package are vulnerable to Symlink Attack via StaticFileHandler.validate_absolute_path in tornado/web.py, which uses os.path.abspath to validate that a requested path remains within the configured static root directory but does not resolve symlinks. An attacker can place or exploit a symlink inside the static directory that points to an arbitrary location on the filesystem, causing StaticFileHandler to serve files outside the intended root - both symlinked files and symlinked directories are affected. The fix introduces a secondary check using os.path.realpath against a configurable allowed_symlink_directory boundary.

    Note: This is only exploitable when a symlink exists inside the configured static directory pointing to a location outside it.

    How to fix Symlink Attack?

    Upgrade tornado to version 6.5.9 or higher.

    [,6.5.9)
    • H
    Improper Handling of Highly Compressed Data (Data Amplification)

    tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

    Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via curl_httpclient.py in CurlAsyncHTTPClient, which passes every chunk libcurl produces to IOLoop.add_callback without bounding the amount of buffered data. When decompress_response is enabled, an attacker-controlled server can send a decompression bomb - a small compressed payload that expands to gigabytes - causing all decompressed chunks to accumulate in the IOLoop's callback queue and exhausting process memory. Additionally, without a streaming_callback, curl_httpclient had no max_body_size limit, allowing a server to buffer arbitrarily large response bodies.

    How to fix Improper Handling of Highly Compressed Data (Data Amplification)?

    Upgrade tornado to version 6.5.9 or higher.

    [,6.5.9)
    • M
    Allocation of Resources Without Limits or Throttling

    tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in HTTPServerRequest.__init__ in tornado/httputil.py via query strings with a large number of fields. The parse_qs_bytes call used to parse the query string had no argument count limit, allowing an attacker to send a request with a query string containing a very large number of fields and trigger superlinear CPU consumption. In the default configuration, max_header_size (64 KB) caps the query string at roughly 12,700 arguments, which still imposes approximately 47 ms of CPU per request - an order of magnitude beyond the limit enforced on the body path - and applications that raise max_header_size face a proportionally larger impact.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade tornado to version 6.5.9 or higher.

    [,6.5.9)
    Go back to all versions of this package