CVE-2014-9720 Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
MediumCVSS 6.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi tornado(PyPI) | < 3.2.2 | 3.2.2 |
| pypi tornado(PyPI) | = 0.2 | No fix listed |
| pypi tornado(PyPI) | = 1.0 | No fix listed |
| pypi tornado(PyPI) | = 1.1 | No fix listed |
| pypi tornado(PyPI) | = 1.1.1 | No fix listed |
| pypi tornado(PyPI) | = 1.2 | No fix listed |
| pypi tornado(PyPI) | = 1.2.1 | No fix listed |
| pypi tornado(PyPI) | = 2.0 | No fix listed |
| pypi tornado(PyPI) | = 2.1 | No fix listed |
| pypi tornado(PyPI) | = 2.1.1 | No fix listed |
| pypi tornado(PyPI) | = 2.2 | No fix listed |
| pypi tornado(PyPI) | = 2.2.1 | No fix listed |
| pypi tornado(PyPI) | = 2.3 | No fix listed |
| pypi tornado(PyPI) | = 2.4 | No fix listed |
| pypi tornado(PyPI) | = 2.4.1 | No fix listed |
| pypi tornado(PyPI) | = 3.0 | No fix listed |
| pypi tornado(PyPI) | = 3.0.1 | No fix listed |
| pypi tornado(PyPI) | = 3.0.2 | No fix listed |
| pypi tornado(PyPI) | = 3.1 | No fix listed |
| pypi tornado(PyPI) | = 3.1.1 | No fix listed |
| pypi tornado(PyPI) | = 3.2 | No fix listed |
| pypi tornado(PyPI) | = 3.2.1 | No fix listed |
| pypi tornado(PyPI) | = v3.2.1 | No fix listed |
| pypi tornado(PyPI) | = v3.2.0 | No fix listed |
| pypi tornado(PyPI) | = v3.2.0b2 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi tornado(PyPI) | = v3.2.0b1 | No fix listed |
| pypi tornado(PyPI) | = v3.1.0 | No fix listed |
| pypi tornado(PyPI) | = v3.0.1 | No fix listed |
| pypi tornado(PyPI) | = v3.0.0 | No fix listed |
| pypi tornado(PyPI) | = v2.1.1 | No fix listed |
| pypi tornado(PyPI) | = v2.3.0 | No fix listed |
| pypi tornado(PyPI) | = v2.2.0 | No fix listed |
| pypi tornado(PyPI) | = v2.1.0 | No fix listed |
| pypi tornado(PyPI) | = v2.0.0 | No fix listed |
| pypi tornado(PyPI) | = v1.2.0 | No fix listed |
| pypi tornado(PyPI) | = v1.1.0 | No fix listed |
| pypi tornado(PyPI) | = v1.0.0 | No fix listed |
| debian/python-tornado(Debian:12) | < 3.2.2-1 | 3.2.2-1 |
| debian/python-tornado(Debian:13) | < 3.2.2-1 | 3.2.2-1 |
| debian/python-tornado(Debian:14) | < 3.2.2-1 | 3.2.2-1 |
| tornadoweb tornado | < 3.2.2 | 3.2.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugzilla.novell.com issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com
- github.com product
- openwall.com mailing-list patch third-party-advisory
- www.tornadoweb.org release-notes vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-9720 vendor-advisory