Bug 822852 (CVE-2012-2374)

Summary:	CVE-2012-2374 python-tornado: Tornado v2.2.1 tornado.web.RequestHandler.set_header() fix to prevent header injection
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ionut, tomspur, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-06 05:52:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	822864, 823214
Bug Blocks:

Description Jan Lieskovsky 2012-05-18 10:35:49 UTC

A possibility of header injection / response splitting flaw was found in the way web request handler of Tornado, a scalable, non-blocking web server and tools, performed sanitization of input arguments, provided to routine setting the HTTP response header name and value. If an application using the Tornado web framework accepted untrusted user input and based on that input updated the HTTP headers content (to redirect the user etc.), by providing a specially-crafted input a remote attacker could use this flaw to perform cross-site scripting attacks, cross-user defacement, web cache poisoning etc.

Upstream v2.2.1 release changelog:
[1] http://www.tornadoweb.org/documentation/releases/v2.2.1.html

References:
[2] https://bugs.gentoo.org/show_bug.cgi?id=415903

Comment 1 Jan Lieskovsky 2012-05-18 10:44:06 UTC

This issue did NOT affect the (current) versions of the python-tornado package, as shipped with Fedora release of 15 and 16 (since they are already upstream v2.2.1 based).

--

This issue affects the version of the python-tornado package, as shipped with Fedora EPEL 6. Please schedule an update / rebase.

Comment 2 Jan Lieskovsky 2012-05-18 10:44:31 UTC

CVE Request:
[3] http://www.openwall.com/lists/oss-security/2012/05/18/6

Comment 3 Jan Lieskovsky 2012-05-18 10:45:40 UTC

Created python-tornado tracking bugs for this issue

Affects: epel-6 [bug 822864]

Comment 4 Kurt Seifried 2012-05-18 17:41:33 UTC

Added CVE as per http://www.openwall.com/lists/oss-security/2012/05/18/12

Comment 5 Thomas Spura 2012-05-20 16:39:47 UTC

*** Bug 823213 has been marked as a duplicate of this bug. ***

Comment 6 Thomas Spura 2012-05-20 16:43:17 UTC

(In reply to comment #1)
> This issue did NOT affect the (current) versions of the python-tornado
> package, as shipped with Fedora release of 15 and 16 (since they are already
> upstream v2.2.1 based).

It DOES affect Fedora as they are upstream 2.2 based, but the version is:
2.2-1
   ^

The Fedora 16 and above tracking bug is bug #823214 (now added as dependency).

Comment 7 Thomas Spura 2012-05-20 21:05:22 UTC

It seems bodhi doesn't play well with the new bugzilla-4.2, so here are the updates:
https://admin.fedoraproject.org/updates/python-tornado-2.2.1-1.el6
https://admin.fedoraproject.org/updates/python-tornado-2.2.1-1.fc15
https://admin.fedoraproject.org/updates/python-tornado-2.2.1-1.fc16
https://admin.fedoraproject.org/updates/python-tornado-2.2.1-1.fc17

Comment 8 Jan Lieskovsky 2012-05-21 07:15:14 UTC

(In reply to comment #6)
> (In reply to comment #1)
> > This issue did NOT affect the (current) versions of the python-tornado
> > package, as shipped with Fedora release of 15 and 16 (since they are already
> > upstream v2.2.1 based).
> 
> It DOES affect Fedora as they are upstream 2.2 based, but the version is:
> 2.2-1
>    ^

Ah, right, correct (when have been looked at NVR overlooked there are just two numbers). Thank you for being so cautios and for the updates.

Comment 9 Fedora Update System 2012-05-29 16:19:44 UTC

python-tornado-2.2.1-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2012-05-29 21:55:58 UTC

python-tornado-2.2.1-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2012-05-29 21:58:30 UTC

python-tornado-2.2.1-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Thomas Spura 2012-06-06 05:52:16 UTC

Fedora and epel-6 are now stable.

Closing, thanks for the notification of this flaw.