tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl: 2 vulnerabilities (highest severity is: 6.1)
mend-bolt-for-github opened this issue · comments
Vulnerable Library - tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Found in HEAD commit: 49939a7d3bf790c17e5165de2c4265f0082cc165
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (tornado version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-28370 |  Medium |
6.1 | tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Direct | 6.3.2 | ❌ |
| WS-2023-0296 | Medium |
5.6 | tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Direct | 6.3.3 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-28370
Vulnerable Library - tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Dependency Hierarchy:
- ❌ tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library)
Found in HEAD commit: 49939a7d3bf790c17e5165de2c4265f0082cc165
Found in base branch: main
Vulnerability Details
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
Publish Date: 2023-05-25
URL: CVE-2023-28370
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2023-05-25
Fix Resolution: 6.3.2
Step up your Open Source Security Game with Mend here
WS-2023-0296
Vulnerable Library - tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Dependency Hierarchy:
- ❌ tornado-6.2-cp37-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library)
Found in HEAD commit: 49939a7d3bf790c17e5165de2c4265f0082cc165
Found in base branch: main
Vulnerability Details
Tornado vulnerable to HTTP request smuggling via improper parsing of Content-Length fields and chunk lengths
Publish Date: 2023-08-15
URL: WS-2023-0296
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-qppv-j76h-2rpx
Release Date: 2023-08-15
Fix Resolution: 6.3.3
Step up your Open Source Security Game with Mend here