USN-8952-3: python-tornado regression
USN-8952-2 fixed a regression in Tornado that broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter. Unfortunately, that update's incomplete fix could introduce a regression by rejecting symlinks into system directories like /usr/share, which distribution packages use for their JavaScript and fonts, causing web UIs to return 403 errors. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 4.2.1-1ubuntu3.1+esm6 - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 4.5.3-1ubuntu0.2+esm6 - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 6.0.3+really5.1.1-3ubuntu0.1~esm9 - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 6.1.0-3ubuntu0.1~esm8 - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 6.4.0-1ubuntu0.8 - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 6.5.5-5ubuntu1.3 - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in 6.5.4-0.1ubuntu0.4 - Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Patch USN-8952-2
Event History
Frequently Asked Questions
What deployments are most likely to experience this regression?
Applications that subclass Tornado's StaticFileHandler, including Jupyter, may be affected when they serve static assets through symlinks into system directories such as /usr/share. Distribution-packaged JavaScript and fonts are specifically identified as affected asset types.
How would this regression appear to users?
Web user interfaces may return HTTP 403 errors when attempting to load static files whose paths use symlinks into system directories.
What should administrators do?
Apply this update, which fixes the incomplete prior fix in USN-8952-2 that caused the static-file-serving regression.