CVE-2014-9720

Description

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

How to fix CVE-2014-9720

To remediate CVE-2014-9720, upgrade the affected package to a fixed version below.

• Debian/python-tornado—upgrade to 3.2.2-1 or later
• —upgrade to 1.0.1-1+deb6u1 or later
• —upgrade to 2.3-2+deb7u1 or later
• —upgrade to 3.2.2 or later
• —upgrade to 1c36307463b1e8affae100bf9386948e6c1b2308 or later

Is CVE-2014-9720 being exploited?

Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 3.2.2-1
• from 0, < 1.0.1-1+deb6u1
• from 0, < 2.3-2+deb7u1
• from 0, < 3.2.2
• from 0, < 1c36307463b1e8affae100bf9386948e6c1b2308 | from 0, < 3.2.2

CVSS scores

References (10)

• ADVISORYgithub.com/advisories/GHSA-8vpw-mgpf-mpvv
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-9720
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-9720
• PATCHgithub.com/tornadoweb/tornado
• WEB