c3ee285ce0
+ Security Improvements:
* Parsing of the cookie header is now much more efficient. The older
algorithm sometimes had quadratic performance which allowed for a
denial-of-service attack in which the server would spend excessive
CPU time parsing cookies and block the event loop.
(CVE-2024-52804, bsc#1233668)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=44
14 lines
629 B
Diff
14 lines
629 B
Diff
Index: tornado-6.4/tornado/iostream.py
|
|
===================================================================
|
|
--- tornado-6.4.orig/tornado/iostream.py
|
|
+++ tornado-6.4/tornado/iostream.py
|
|
@@ -1374,7 +1374,7 @@ class SSLIOStream(IOStream):
|
|
return
|
|
elif err.args[0] in (ssl.SSL_ERROR_EOF, ssl.SSL_ERROR_ZERO_RETURN):
|
|
return self.close(exc_info=err)
|
|
- elif err.args[0] == ssl.SSL_ERROR_SSL:
|
|
+ elif err.args[0] in (ssl.SSL_ERROR_SSL, ssl.SSL_ERROR_SYSCALL):
|
|
try:
|
|
peer = self.socket.getpeername()
|
|
except Exception:
|