[ubuntu/resolute-security] python-tornado 6.5.4-0.1ubuntu0.1 (Accepted)

[Hlib Korzhynskyy]

python-tornado (6.5.4-0.1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service when parsing large multipart bodies.
    - debian/patches/CVE-2026-31958.patch: Add limit of 100 parts and enforce
      checks in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - CVE-2026-31958
  * SECURITY UPDATE: Cookie attribute injection.
    - debian/patches/CVE-2026-35536.patch: Raise CookieError on invalid
      characters in tornado/web.py. Add tests in tornado/test/web_test.py.
    - CVE-2026-35536

Date: 2026-04-28 17:50:10.410102+00:00
Changed-By: Hlib Korzhynskyy <hlib.korzhynskyy at canonical.com>
https://launchpad.net/ubuntu/+source/python-tornado/6.5.4-0.1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.