[Pkg-salt-team] Bug#1059297: salt: CVE-2023-28370
Moritz Mühlenhoff
jmm at inutil.org
Fri Dec 22 12:51:02 GMT 2023
Source: salt
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for Tornado, which is
embedded by Salt:
CVE-2023-28370[0]:
| Open redirect vulnerability in Tornado versions 6.3.1 and earlier
| allows a remote unauthenticated attacker to redirect a user to an
| arbitrary web site and conduct a phishing attack by having user
| access a specially crafted URL.
https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f (v6.3.2)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-28370
https://www.cve.org/CVERecord?id=CVE-2023-28370
Please adjust the affected versions in the BTS as needed.
More information about the pkg-salt-team
mailing list