Red Hat Security Advisory: python-tornado security update

The python-tornado library, a Python web framework and asynchronous networking library, contains a denial of service vulnerability in its HTTP cookie parsing component (CVE-2024-52804). Red Hat has issued a security advisory (RHSA-2024:10836) for Red Hat Enterprise Linux 9.2 Extended Update Support, providing updated python-tornado packages (version 6.4.2-1.el9_2) that address this issue. The advisory classifies the security impact as Important and recommends applying the update to remediate the vulnerability. The advisory does not provide a CVSS score but references the CVE page for further details. The vulnerability is related to CWE-444 and CWE-1333, indicating issues with HTTP request handling and denial of service.

The vulnerability allows an attacker to cause a denial of service condition by exploiting the HTTP cookie parsing in python-tornado. This could lead to service disruption for applications using the affected library. No information about active exploitation in the wild is reported. The impact is limited to denial of service and does not indicate code execution or data compromise.

Red Hat has released updated python-tornado packages (version 6.4.2-1.el9_2) for Red Hat Enterprise Linux 9.2 Extended Update Support that fix the HTTP cookie parsing DoS vulnerability. Users should apply these official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issue. No additional mitigations are indicated or required beyond applying the provided patch.