CVE-2026-49853
highPriorität · verfolgen · 0EPSS 0.004 · 38. PerzentilDEEUUSEPSS · bewertet 2026-10-22
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
- Red Hat Enterprise Linux tornadoalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:python-tornado__6.4.2
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-3870Red Hat Enterprise Linux (python-tornado): Mehrere SchwachstellenDeutsch2026-10-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in python-tornado in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen
- GHSA-3x9g-8vmp-wqvfTornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient2026-06-15ghsa · osvUS
## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, `SimpleAsyncHTTPClient` matches the default behavior of `libcurl` (and therefore `CurlAsyncHTTPClient`): When a redirect changes the scheme, host, or port of the url, the `Authorization` and `Cookie` headers will be removed when following the redirect.
- PYSEC-2026-3387Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient2026-07-13vendor · osvUS
## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, `SimpleAsyncHTTPClient` matches the default behavior of `libcurl` (and therefore `CurlAsyncHTTPClient`): When a redirect changes the scheme, host, or port of the url, the `Authorization` and `Cookie` headers will be removed when following the redirect.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751cnnvd
- https://github.com/tornadoweb/tornado/pull/3626cnnvd
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.6cnnvd
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvfcnnvd
- https://www.tornadoweb.org/Patchcnnvd
- https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751enisa_euvd
- https://github.com/tornadoweb/tornado/pull/3626enisa_euvd
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.6enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan