USN-7150-1: Tornado vulnerabilities
It was discovered that Tornado incorrectly handled a certain redirect. A remote attacker could possibly use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having the user access a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously addressed in USN-6159-1. (CVE-2023-28370) It was discovered that Tornado inefficiently handled requests when parsing cookies. An attacker could possibly use this issue to increase resource utilization leading to a denial of service. (CVE-2024-52804)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7150-1?
The severity of USN-7150-1 is rated as high due to the potential for remote attackers to redirect users to malicious sites.
How do I fix USN-7150-1?
To fix USN-7150-1, update the affected python3-tornado package to the recommended version as specified in the advisory.
What versions of Ubuntu are affected by USN-7150-1?
USN-7150-1 affects multiple versions of Ubuntu, including 20.04, 22.04, 24.04, and 24.10.
Can USN-7150-1 lead to phishing attacks?
Yes, USN-7150-1 can allow remote attackers to conduct phishing attacks through misleading redirects.
Should I be concerned about USN-7150-1 if my system is patched?
If your system is up-to-date with the necessary patches for USN-7150-1, you should not be concerned.