HTTP Request Smuggling Affecting tornado package, versions [,6.3.3)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TORNADO-6041512
- published 1 Nov 2023
- disclosed 1 Nov 2023
- credit Ben Kallus
How to fix?
Upgrade tornado to version 6.3.3 or higher.
Overview
tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to HTTP Request Smuggling via the parse and validate strings capabilities in the int constructor.
Notes:
- This is possible when Tornado is deployed behind certain proxies that interpret those non-standard characters differently.
- This is known to apply to older versions of
haproxy, although the current release is not affected.
References
CVSS Scores
version 3.1