Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1248347

Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: python-tornado@packages.debian.org
Control: affects -1 + src:python-tornado
User: release.debian.org@packages.debian.org
Usertags: pu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

[ Reason ]
This upload intends to fix the vulnerability CVE-2025-47287.

CVE-2025-47287 allows a remote attacker to create an extremely high volume of
log entries, constituting a DoS attack.

[ Impact ]
Users of Debian Bookworm will continue to be vulnerable to the mentioned issues
if the update is not approved.

[ Tests ]
The package comes with the testsuite enabled. The tests were adjusted to match
the new behavior to throw errors instead of logging warnings. All tests succeed.

[ Risks ]
The changes are quite simple. However, regressions are always possible. The
fact that the tests are successful reduce the risk of regressions.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Instead of logging warning messages, errors are created which preserve the
backtrace. Parsing the body has been moved within the code into
RequestHandler._execute() to be in the right exception handler scope. The tests
have been adjusted to this change.

[ Other info ]
All patches contain links to the original reports and commits.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmg5KDUACgkQS80FZ8KW
0F1sIw//dTsOnVtiz826x6FGeL7kUAK4BPs587XaPQgdu31TzDKHbkc5xDAE+Nas
Ay4vZMvlGAQmEsb6H/z+2F4aYgDKmoYojTfs/fRorMebieixeimVAE9J/NT0o436
cDzuuxhJkjghKDPFcSOoPNr1iFCoGbtTNpIHgPXn4cFRbryzGQwbYg26f9sIX5Mt
46P1E1lKcis0sIR19kt2Ri2dFi+GWZODCNmBzFZIW0pLhIs14TU4+cBv6yjCF51d
VUu8wKX63UnIbd3iilcPC7HvN65U4zn9YiBmSR/F9co2zRCrlxMdX7neb7DVkHvz
7Fz7yWJ28WE4CDq7AFp3ESsGgX0ySsTOuofMPJoMpWkMAI0tcRdPvypETSbtfnMr
OlsnwMwL1xZWxDrpHlRqirS8hpELmFpywlT8LxWknqHAv53ZOH42HtXabYzw+I0+
hT6UjMV4Ihv6HRbNXIAVFeIiLoJQMuexxtA71bZ3YzxvHhsfQmntKiyxDHRE4mqL
2lxzQQpFGkIaSNAkTVbUF9b4Qu9BPLhwvfL2OI43y6SAvM3UAfMR2lM8o6/Y+yjI
Er4pY4WDJ2CsNoFAY4nZLfSRbmGNHnqjAp3Hx2DCrBBpATyu+qgyOqgsH/sLTSUG
DXY1qaNJCvERiLOKaRFUoJpnESwemLyB0Q2BFKgzJHgHy9fIk1w=
=Cx9E
-----END PGP SIGNATURE-----

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-05-30 05:50 +0200
  Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Salvatore Bonaccorso <carnil@debian.org> - 2025-06-03 08:50 +0200
    Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-06-03 13:50 +0200
      Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Moritz Mühlenhoff <jmm@inutil.org> - 2025-06-03 23:10 +0200
        Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-06-04 11:00 +0200
          Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Salvatore Bonaccorso <carnil@debian.org> - 2025-06-04 16:50 +0200
            Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-06-05 02:20 +0200

csiph-web