[Pkg-salt-team] Bug#1059297: salt: CVE-2023-28370

[Moritz Mühlenhoff]

Source: salt
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for Tornado, which is
embedded by Salt:

CVE-2023-28370[0]:
| Open redirect vulnerability in Tornado versions 6.3.1 and earlier
| allows a remote unauthenticated attacker to redirect a user to an
| arbitrary web site and conduct a phishing attack by having user
| access a specially crafted URL.

https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f (v6.3.2)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-28370
    https://www.cve.org/CVERecord?id=CVE-2023-28370

Please adjust the affected versions in the BTS as needed.