Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.
Weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | python-tornado-0:6.5.8-0.el10_2.1 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | python-tornado-0:6.5.8-0.el10_0.1 | * |
| Red Hat Enterprise Linux 9 | RedHat | python-tornado-0:6.5.8-0.el9_8.1 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | python-tornado-0:6.4.2-2.el9_6.7 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-feature-server-rhel9:1792148523 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-llama-stack-core-rhel9:1791873747 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1791315854 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:1791393968 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1791902759 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1791867208 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1791867137 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1791902535 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1791867196 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1791288400 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1791869442 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:1791870787 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:1791867222 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:1791903144 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1791867191 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1791867189 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1791867238 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1791867244 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1791867230 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1792563127 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-llama-stack-core-rhel9:1789121286 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-feature-server-rhel9:1791863220 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-llama-stack-core-rhel9:1790958470 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-cpu-torch210-py312-rhel9:1791874335 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-cuda130-torch210-py312-rhel9:1791961113 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-rocm64-torch291-py312-rhel9:1791872119 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-trustyai-nemo-guardrails-server-rhel9:1791556128 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1791952873 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:1791572004 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1791816462 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1791816487 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1791951049 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1791951047 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1791950760 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-trustyai-nemo-guardrails-server-rhel9:1791566631 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1791825469 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1791903880 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:1791572098 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:1791572144 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:1791572102 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1791817064 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1791817844 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1791816223 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1791899290 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1791816175 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1791816316 | * |