From http://www.tornadoweb.org/en/stable/releases/v3.2.2.html Security fixes The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy). Backwards-compatibility notes If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers. Upstream patch: https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308
Created python-tornado tracking bugs for this issue: Affects: fedora-all [bug 1222819] Affects: epel-all [bug 1222820]
python-tornado-3.2.2-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
python-tornado-3.2.2-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Analysis: BREACH attack misuses the interaction between compression and encryption to extract secrets from encrypted message. If attacker can control part of the message being encrypted, which contains a secret, he could observe lengths of encrypted messages to infer which strings were present in the message before compression, with the idea that message containing multiple occurrences of some substring should be compressed more efficiently. Given the scenario where client sends a HHTP request M to the server containing secret S (CSRF token) and * attacker can inject strings into message M *before* S appears * attacker can observe length of the encrypted request then attacker can start iterating over all possible strings P and constructing M=a + P + b + S + c, where a,b,c are any data, and observing the length of the compressed and encrypted message. If the secret S contains string P, compression algorithm will output shorter message, than in the case S does not contain P. By iterating over all P, attacker can infer from the length of compressed and encrypted requests which string P are contained in S, thus revealing the secret. The fix for this flaw masks secret S (CSRF) token by XORing it with random string. This prevents BREACH attack, because every request now contain string S'=S xor R, which is different for every message, instead of a fixed secret S. External references: http://www.tornadoweb.org/en/stable/releases/v3.2.2.html