| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Upgrade to release 6.4.2 which brings security improvements:
Parsing of the cookie header is now much more efficient. The older
algorithm sometimes had quadratic performance which allowed for a
denial-of-service attack in which the server would spend
excessive CPU time parsing cookies and block the event loop.
This change fixes CVE-2024-7592.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
| |
|
|
|
|
|
|
| |
Support has been there for few years now [1]
[1] https://github.com/tornadoweb/tornado/commit/e71fb6e616e08838df55dddb494c96a80454f812
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
|
|
Upgrade to version 6.4.1:
- Parsing of the Transfer-Encoding header is now stricter.
- Handling of whitespace in headers now matches the RFC more
closely. Only space and tab characters are treated as whitespace
and stripped from the beginning and end of header values.
- tornado.curl_httpclient now prohibits carriage return and
linefeed headers in HTTP headers.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
