CVE-2014-9720: PYSEC-2020-213 - Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier

CVE-2014-9720 · Severity: low · CVSS 3.1 · Published 2020-01-24

Technologies: tornado (PyPI). Vendors: PyPI.

Executive brief

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Affected products

PyPI tornado

Related threats

Tornado multipart form data memory amplification DoS in httputil.py
Tornado cookie attribute injection via case-insensitive kwargs
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded requ
Tornado quadratic DoS in httputil _parseparam
Tornado quadratic DoS via repeated header coalescing