[Git][security-tracker-team/security-tracker][master] Track fixed version for python-tornado issues via unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 31 07:02:45 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6aee80de by Salvatore Bonaccorso at 2026-10-31T07:48:11+01:00
Track fixed version for python-tornado issues via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -7425,14 +7425,14 @@ CVE-2026-116579 (Autobahn Python is a WebSocket and WAMP implementation for Pyth
NOTE: https://github.com/crossbario/autobahn-python/pull/1987
NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1 (v26_10_1)
CVE-2026-116578 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1152300)
+ - python-tornado 6.6.0-1 (bug #1152300)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p
NOTE: https://github.com/tornadoweb/tornado/pull/3786
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233 (v6.6.0b1)
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117 (v6.6.0rc1)
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035 (v6.6.0rc1)
CVE-2026-116577 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1152300)
+ - python-tornado 6.6.0-1 (bug #1152300)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c
NOTE: https://github.com/tornadoweb/tornado/pull/3765
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9 (v6.6.0b1)
@@ -7473,7 +7473,7 @@ CVE-2026-116478 (A vulnerability was detected in a2aproject a2a-go up to 2.4.0.
CVE-2026-116477 (A security vulnerability has been detected in a2aproject a2a-dotnet up ...)
TODO: check
CVE-2026-115927 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1152300)
+ - python-tornado 6.6.0-1 (bug #1152300)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985
NOTE: https://github.com/tornadoweb/tornado/pull/3773
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8 (v6.6.0b1)
@@ -43900,15 +43900,15 @@ CVE-2026-103265 (Fleet versions before 4.89.0 fail to properly filter MDM comman
CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass vulnerab ...)
NOT-FOR-US: Fleet
CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability in Static ...)
- - python-tornado <unfixed> (bug #1149712)
+ - python-tornado 6.6.0-1 (bug #1149712)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 (v6.5.9)
CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory accumulation ...)
- - python-tornado <unfixed> (bug #1149712)
+ - python-tornado 6.6.0-1 (bug #1149712)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9 (v6.5.9)
CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query string fields ...)
- - python-tornado <unfixed> (bug #1149712)
+ - python-tornado 6.6.0-1 (bug #1149712)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93 (v6.5.9)
CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approva ...)
@@ -68671,18 +68671,18 @@ CVE-2026-91994 (Semaphore UI through 2.19.12 exempts GET and HEAD requests from
CVE-2026-91993 (Jpom through 2.11.12 fails to validate workspace ownership when resolv ...)
NOT-FOR-US: Jpom
CVE-2026-91992 (Tornado before 6.5.7 contains a credential leak vulnerability in CurlA ...)
- - python-tornado <unfixed> (bug #1148323)
+ - python-tornado 6.6.0-1 (bug #1148323)
[trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43 (v6.5.7)
CVE-2026-91991 (Tornado before 6.5.8 contains an incomplete fix for cookie attribute i ...)
- - python-tornado <unfixed> (bug #1148323)
+ - python-tornado 6.6.0-1 (bug #1148323)
[trixie] - python-tornado <not-affected> (Incomplete fix for CVE-2026-35536 not applied)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7 (v6.5.8)
NOTE: CVE exists because of an incomplete fix for CVE-2026-35536
CVE-2026-91990 (Tornado before 6.5.8 contains a memory amplification vulnerability in ...)
- - python-tornado <unfixed> (bug #1148323)
+ - python-tornado 6.6.0-1 (bug #1148323)
[trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05 (v6.5.8)
@@ -86979,7 +86979,7 @@ CVE-2026-82398 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3947
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa (6.15.0)
CVE-2026-82397 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1146475)
+ - python-tornado 6.6.0-1 (bug #1146475)
[trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de (v6.5.8)
@@ -143784,17 +143784,17 @@ CVE-2026-49978 (DOMPurify is a DOM-only cross-site scripting sanitizer for HTML,
NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq
NOTE: Fixed by: https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff (3.4.7)
CVE-2026-49855 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1142277)
+ - python-tornado 6.6.0-1 (bug #1142277)
[trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff (v6.5.6)
CVE-2026-49854 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1142277)
+ - python-tornado 6.6.0-1 (bug #1142277)
[trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac (v6.5.6)
CVE-2026-49853 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed> (bug #1142277)
+ - python-tornado 6.6.0-1 (bug #1142277)
[trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5 (v6.5.6)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6aee80de2be76e5afbacb381a2e5ad3d5d18a915
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6aee80de2be76e5afbacb381a2e5ad3d5d18a915
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/2c3bee1a/attachment.htm>
More information about the debian-security-tracker-commits
mailing list