opensuse-su-2025:15838-1
Vulnerability from csaf_opensuse
Published
2025-12-20 00:00
Modified
2025-12-20 00:00
Summary
python311-tornado6-6.5.4-1.1 on GA media

Notes

Title of the patch
python311-tornado6-6.5.4-1.1 on GA media
Description of the patch
These are all security issues fixed in the python311-tornado6-6.5.4-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15838
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python311-tornado6-6.5.4-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python311-tornado6-6.5.4-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15838",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15838-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-67724 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-67724/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-67725 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-67725/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-67726 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-67726/"
      }
    ],
    "title": "python311-tornado6-6.5.4-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-12-20T00:00:00Z",
      "generator": {
        "date": "2025-12-20T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15838-1",
      "initial_release_date": "2025-12-20T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-12-20T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-tornado6-6.5.4-1.1.aarch64",
                "product": {
                  "name": "python311-tornado6-6.5.4-1.1.aarch64",
                  "product_id": "python311-tornado6-6.5.4-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-tornado6-6.5.4-1.1.aarch64",
                "product": {
                  "name": "python312-tornado6-6.5.4-1.1.aarch64",
                  "product_id": "python312-tornado6-6.5.4-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-tornado6-6.5.4-1.1.aarch64",
                "product": {
                  "name": "python313-tornado6-6.5.4-1.1.aarch64",
                  "product_id": "python313-tornado6-6.5.4-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-tornado6-6.5.4-1.1.ppc64le",
                "product": {
                  "name": "python311-tornado6-6.5.4-1.1.ppc64le",
                  "product_id": "python311-tornado6-6.5.4-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python312-tornado6-6.5.4-1.1.ppc64le",
                "product": {
                  "name": "python312-tornado6-6.5.4-1.1.ppc64le",
                  "product_id": "python312-tornado6-6.5.4-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-tornado6-6.5.4-1.1.ppc64le",
                "product": {
                  "name": "python313-tornado6-6.5.4-1.1.ppc64le",
                  "product_id": "python313-tornado6-6.5.4-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-tornado6-6.5.4-1.1.s390x",
                "product": {
                  "name": "python311-tornado6-6.5.4-1.1.s390x",
                  "product_id": "python311-tornado6-6.5.4-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python312-tornado6-6.5.4-1.1.s390x",
                "product": {
                  "name": "python312-tornado6-6.5.4-1.1.s390x",
                  "product_id": "python312-tornado6-6.5.4-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-tornado6-6.5.4-1.1.s390x",
                "product": {
                  "name": "python313-tornado6-6.5.4-1.1.s390x",
                  "product_id": "python313-tornado6-6.5.4-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-tornado6-6.5.4-1.1.x86_64",
                "product": {
                  "name": "python311-tornado6-6.5.4-1.1.x86_64",
                  "product_id": "python311-tornado6-6.5.4-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-tornado6-6.5.4-1.1.x86_64",
                "product": {
                  "name": "python312-tornado6-6.5.4-1.1.x86_64",
                  "product_id": "python312-tornado6-6.5.4-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-tornado6-6.5.4-1.1.x86_64",
                "product": {
                  "name": "python313-tornado6-6.5.4-1.1.x86_64",
                  "product_id": "python313-tornado6-6.5.4-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-tornado6-6.5.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64"
        },
        "product_reference": "python311-tornado6-6.5.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-tornado6-6.5.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le"
        },
        "product_reference": "python311-tornado6-6.5.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-tornado6-6.5.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x"
        },
        "product_reference": "python311-tornado6-6.5.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-tornado6-6.5.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64"
        },
        "product_reference": "python311-tornado6-6.5.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-tornado6-6.5.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64"
        },
        "product_reference": "python312-tornado6-6.5.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-tornado6-6.5.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le"
        },
        "product_reference": "python312-tornado6-6.5.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-tornado6-6.5.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x"
        },
        "product_reference": "python312-tornado6-6.5.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-tornado6-6.5.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64"
        },
        "product_reference": "python312-tornado6-6.5.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-tornado6-6.5.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64"
        },
        "product_reference": "python313-tornado6-6.5.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-tornado6-6.5.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le"
        },
        "product_reference": "python313-tornado6-6.5.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-tornado6-6.5.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x"
        },
        "product_reference": "python313-tornado6-6.5.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-tornado6-6.5.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
        },
        "product_reference": "python313-tornado6-6.5.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-67724",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-67724"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom \"reason\" phrases (the \"Not Found\" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-67724",
          "url": "https://www.suse.com/security/cve/CVE-2025-67724"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254903 for CVE-2025-67724",
          "url": "https://bugzilla.suse.com/1254903"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-67724"
    },
    {
      "cve": "CVE-2025-67725",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-67725"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server\u0027s event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each concatenation copies the entire string, resulting in O(n) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-67725",
          "url": "https://www.suse.com/security/cve/CVE-2025-67725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254905 for CVE-2025-67725",
          "url": "https://bugzilla.suse.com/1254905"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-67725"
    },
    {
      "cve": "CVE-2025-67726",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-67726"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server\u0027s CPU usage increases quadratically (O(n)) during parsing. Due to Tornado\u0027s single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
          "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-67726",
          "url": "https://www.suse.com/security/cve/CVE-2025-67726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254904 for CVE-2025-67726",
          "url": "https://bugzilla.suse.com/1254904"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python311-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python312-tornado6-6.5.4-1.1.x86_64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-tornado6-6.5.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-67726"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.