[SECURITY] [DSA 6195-1] python-tornado security update To : debian-security-announce@lists.debian.org Subject : [SECURITY] [DSA 6195-1] python-tornado security update From : Moritz Muehlenhoff < jmm@debian.org > Date : Fri, 3 Apr 2026 21:38:17 +0000 Message-id : < [🔎] adAzSSbhdZh7L_cY@seger.debian.org > Reply-to : debian-security-announce-request@lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6195-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff April 03, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : python-tornado CVE ID : CVE-2025-67724 CVE-2025-67725 CVE-2025-67726 Multiple security vulnerabilities were discovered in the Tornado Python web framework, which could result in denial of service, header injection or cross-site scripting. For the oldstable distribution (bookworm), this problem has been fixed in version 6.2.0-3+deb12u4. For the stable distribution (trixie), this problem has been fixed in version 6.4.2-3+deb13u2. We recommend that you upgrade your python-tornado packages. For the detailed security status of python-tornado please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-tornado Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmnQMy0ACgkQEMKTtsN8 TjavQA/+ILpmcy79oz+6awTlX/1/EaLWXT6bMyir6PiJoq8ndgHKoug+C5MrnW2F lI3a8HG+QnMUjrd38b8kQxFhndwWHDS37FqeitMyBG6UgI0YGc8JRTB1iNGhhZPN 2xlas2VsJJ1hJe5dOGAUEH6iEXzrdJgsm1neveiw/KWLJ7G5B5t3YRdeQ1aHDMWt arnNUFb1aqZ8qTPrcW9R6c9nNQpD81h7L7w7MXp7EZwoW0eRCqX/seVtkTkrbgVk hB2eh0LgD8vfpiMk3vl4ebC7CeJVK4M4DAnhInD2Ke/cdP4iyLtjmKIAdSfhlZdl /q6gnxomKfBKG9JXuvQdsINSFsQn/TRBv3sHEpvqFQpGZYqVC+ZsnOwapIaja4IG 6O3DKTmFwPyQMBPQegCmLZqQGBOJ8ZJT14/Exf/IReXa3vd5vkJopvK72aXmh/H8 x+UXGCUe9pLTYlgNF5Xu7lkjbAbYjNaW0QeIYoi1/b6NIEQlkcvrthKMoUQPsD0l YJbW215gW4u00ztH0lT2cxlnfnUWS/m2y93z5uRlG8ivmE14qlcBZig0oF7puMnO mu+yg4HMRAMzLI40trFi+08hRpPZxFreqJgw37QrbyLfdbwk9164yJrZkQCMbxYh joT9OZ64bacx6GyCp+op93kXyAY1QskQCV+ni0iVSb6OCB+KFek= =F4/1 -----END PGP SIGNATURE----- Reply to: debian-security-announce@lists.debian.org Moritz Muehlenhoff (on-list) Moritz Muehlenhoff (off-list) Prev by Date: [SECURITY] [DSA 6194-1] pyasn1 security update Previous by thread: [SECURITY] [DSA 6194-1] pyasn1 security update Index(es): Date Thread