In Python Tornado versions prior to 6.5.5, the set_cookie method in RequestHandler does not properly validate the domain, path, and samesite parameters. This lack of input sanitization enables cookie attribute injection, where an attacker could craft malicious cookie attributes. The vulnerability affects multiple specific Ubuntu package versions of Tornado as listed. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and low confidentiality and integrity impacts but no availability impact.

The vulnerability allows an attacker to inject crafted cookie attributes, which can lead to partial compromise of cookie confidentiality and integrity. This may enable session manipulation or other attacks relying on cookie tampering. There is no direct impact on system availability. No known exploits in the wild have been reported.

A fix is available in Tornado version 6.5.5 and later. Users should upgrade to Tornado 6.5.5 or newer to remediate this vulnerability. Since this is not a cloud service, manual patching is required. Check vendor advisories or distribution package updates for official patches corresponding to your environment.