Source: python-tornado Version: 6.2.0-3 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for python-tornado. CVE-2023-28370[0]: | Open redirect vulnerability in Tornado versions 6.3.1 and earlier | allows a remote unauthenticated attacker to redirect a user to an | arbitrary web site and conduct a phishing attack by having user access | a specially crafted URL. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-28370 https://www.cve.org/CVERecord?id=CVE-2023-28370 [1] https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f Please adjust the affected versions in the BTS as needed. Regards, Salvatore
