[Git][security-tracker-team/security-tracker][master] Add three new python-tornado issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f84c744c by Salvatore Bonaccorso at 2026-10-01T22:24:04+02:00
Add three new python-tornado issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -402,11 +402,17 @@ CVE-2026-103265 (Fleet versions before 4.89.0 fail to properly filter MDM comman
 CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass vulnerab ...)
 	NOT-FOR-US: Fleet
 CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability in Static ...)
-	TODO: check
+	- python-tornado <unfixed>
+	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 (v6.5.9)
 CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory accumulation ...)
-	TODO: check
+	- python-tornado <unfixed>
+	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9 (v6.5.9)
 CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query string fields  ...)
-	TODO: check
+	- python-tornado <unfixed>
+	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93 (v6.5.9)
 CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approva ...)
 	NOT-FOR-US: n8n
 CVE-2026-103259 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f84c744c403dc000b4c39326ac6d7c65a70d41fb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f84c744c403dc000b4c39326ac6d7c65a70d41fb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/67417e59/attachment.htm>