Buffer Over-read Affecting tornado package, versions [,6.5.6)

tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

Affected versions of this package are vulnerable to Buffer Over-read via the websocket_mask function in the speedups component. An attacker can trigger a read past the end of the mask string by supplying a mask value shorter or longer than 4 bytes. This can expose adjacent process memory to the caller and can crash the interpreter when the optimized masking path is used.

Notes

• The vulnerable path is the native tornado.speedups extension, which is optional and can be disabled by setting TORNADO_EXTENSION=0; deployments that never load the C extension use the pure-Python masking code instead.
• The behavior is only reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Workarounds

• Set TORNADO_EXTENSION=0 before starting the application to disable the native tornado.speedups extension and avoid the vulnerable websocket_mask path, at the cost of reduced websocket performance.

• GitHub Commit
• Maintainer's Advisory