mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-22 11:00:49 +00:00
Code Issues Projects Releases Wiki Activity

python3-tornado: Fix CVE-2026-31958

Browse Source 
This patch applies the upstream fix as referenced in [2], which addresses a Tornado flaw where
crafted multipart/form-data requests can trigger excessive synchronous parsing and cause
denial of service using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839
[2] https://security-tracker.debian.org/tracker/CVE-2026-31958

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-31958

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Sudhir Dumbhare
2026-06-09 11:37:19 +05:30
committed by Anuj Mittal
parent 0cbca3f031
commit 85aa67fa07
2 changed files with 263 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-python/recipes-devtools/python/python3-tornado_6.4.2.bb
+1
View File
@@ -12,6 +12,7 @@ SRC_URI += "file://CVE-2025-47287.patch \
file://CVE-2025-67724.patch \
file://CVE-2025-67726.patch \
file://CVE-2026-35536.patch \
file://CVE-2026-31958.patch \
"
inherit pypi python_setuptools_build_meta