gpp_maybe Security update for python-tornado6

SUSE-SLE-Micro-6.1-356

This update for python-tornado6 fixes the following issues: - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903). - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add` method can lead to DoS when processing a maliciously crafted HTTP request (bsc#1254905). - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can lead to DoS when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Release Date

Dec 22 2025
References

Bugzilla: 1254903, 1254904, 1254905
CVEs: CVE-2025-67724, CVE-2025-67725, CVE-2025-67726
Type

security
Severity

important

cloud_download Downloads

To download packages, you need to log in and have a valid subscription.

SUSE Linux Micro 6.1 ppc64le

Packages

python311-tornado6
Open source version of scalable, non-blocking web server that power FriendFeed

6.4-slfo.1.1_3.1 lock rpm

SUSE Linux Micro 6.1 aarch64

Packages

python311-tornado6
Open source version of scalable, non-blocking web server that power FriendFeed

6.4-slfo.1.1_3.1 lock rpm

SUSE Linux Micro 6.1 s390x

Packages

python311-tornado6
Open source version of scalable, non-blocking web server that power FriendFeed

6.4-slfo.1.1_3.1 lock rpm

SUSE Linux Micro 6.1 x86_64

Packages

python311-tornado6
Open source version of scalable, non-blocking web server that power FriendFeed

6.4-slfo.1.1_3.1 lock rpm