[Git][security-tracker-team/security-tracker][master] Add patch links for various python-tornado issues

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
00fbf251 by Daniel Leidert at 2026-10-31T03:50:19+01:00
Add patch links for various python-tornado issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -68668,15 +68668,18 @@ CVE-2026-91992 (Tornado before 6.5.7 contains a credential leak vulnerability in
 	- python-tornado <unfixed> (bug #1148323)
 	[trixie] - python-tornado <no-dsa> (Minor issue)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43 (v6.5.7)
 CVE-2026-91991 (Tornado before 6.5.8 contains an incomplete fix for cookie attribute i ...)
 	- python-tornado <unfixed> (bug #1148323)
 	[trixie] - python-tornado <not-affected> (Incomplete fix for CVE-2026-35536 not applied)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7 (v6.5.8)
 	NOTE: CVE exists because of an incomplete fix for CVE-2026-35536
 CVE-2026-91990 (Tornado before 6.5.8 contains a memory amplification vulnerability in  ...)
 	- python-tornado <unfixed> (bug #1148323)
 	[trixie] - python-tornado <no-dsa> (Minor issue)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05 (v6.5.8)
 CVE-2026-91989 (atomic-agents-stack before 1.1.0 contains a path traversal vulnerabili ...)
 	NOT-FOR-US: atomic-agents-stack
 CVE-2026-91988 (atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the ...)
@@ -143788,6 +143791,7 @@ CVE-2026-49853 (Tornado is a Python web framework and asynchronous networking li
 	- python-tornado <unfixed> (bug #1142277)
 	[trixie] - python-tornado <no-dsa> (Minor issue)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
+	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5 (v6.5.6)
 CVE-2026-49808 (Concurrent execution using shared resource with improper synchronizati ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-49807 (Exposure of sensitive information to an unauthorized actor in Windows  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00fbf251ab0de74ee020e8b4795d630a525046d2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00fbf251ab0de74ee020e8b4795d630a525046d2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/3b69b071/attachment.htm>