id: PYSEC-2020-213
details: Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF
  token and may be sent with HTTP compression, which makes it easier for remote attackers
  to conduct a BREACH attack and determine this token via a series of crafted requests.
affected:
- package:
    name: tornado
    ecosystem: PyPI
    purl: pkg:pypi/tornado
  ranges:
  - type: GIT
    repo: https://github.com/tornadoweb/tornado
    events:
    - introduced: "0"
    - fixed: 1c36307463b1e8affae100bf9386948e6c1b2308
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.2.2
  versions:
  - "0.2"
  - "1.0"
  - "1.1"
  - 1.1.1
  - "1.2"
  - 1.2.1
  - "2.0"
  - "2.1"
  - 2.1.1
  - "2.2"
  - 2.2.1
  - "2.3"
  - "2.4"
  - 2.4.1
  - "3.0"
  - 3.0.1
  - 3.0.2
  - "3.1"
  - 3.1.1
  - "3.2"
  - 3.2.1
references:
- type: FIX
  url: 
    https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308
- type: REPORT
  url: https://bugzilla.novell.com/show_bug.cgi?id=930362
- type: WEB
  url: http://openwall.com/lists/oss-security/2015/05/19/4
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1222816
- type: WEB
  url: http://www.tornadoweb.org/en/stable/releases/v3.2.2.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8vpw-mgpf-mpvv
aliases:
- CVE-2014-9720
- GHSA-8vpw-mgpf-mpvv
modified: "2021-07-05T00:01:27.333585Z"
published: "2020-01-24T18:15:00Z"