Red Hat Security Advisory: python-tornado security update

The python-tornado library, a Python web framework and asynchronous networking library, contains a denial of service vulnerability in its HTTP cookie parsing code (CVE-2024-52804). This vulnerability is addressed in an update provided by Red Hat for their Enterprise Linux 9.4 Extended Update Support and related distributions. The advisory references CVE-2024-14029 as well, but the primary fix is for the cookie parsing DoS issue. The update to python-tornado version 6.4.2-1.el9_4 mitigates this vulnerability.

The vulnerability allows an attacker to cause a denial of service condition by exploiting the HTTP cookie parsing mechanism in python-tornado. This could disrupt availability of services relying on Tornado for web serving or asynchronous networking. No known exploits in the wild have been reported at this time.

Red Hat has released an updated python-tornado package (version 6.4.2-1.el9_4) that fixes the HTTP cookie parsing DoS vulnerability. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support and related variants should apply this update promptly. For detailed update instructions, refer to Red Hat's official advisory and article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.