This update for python-tornado fixes the following issues:
- CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of
Content-Length headers accepting non-standard characters. At (bsc#1280689).
- CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
- CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for resource exhaustion
and a denial of service (bsc#1281439).
- CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via semicolon-
delimited data in capitalized parameters
This update for python-tornado fixes the following issue:
- CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously
stall the single-threaded event loop and delay every connection (bsc#1277725).
This update for python-tornado fixes the following issues:
- GHSA-pw6j-qg29-8w7f: `CurlAsyncHTTPClient` leaks per-request credentials on handle reuse (bsc#1269012).
This update for python-tornado fixes the following issues
- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).
This update for python-tornado fixes the following issues:
- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes
(bsc#1259630).
This update for python-tornado fixes the following issues:
- CVE-2025-67725: inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905).
- CVE-2025-67726: Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method (bsc#1254904).
This update for python-tornado fixes the following issues:
- CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-service
(bsc#1243268).
This update fixes the following issues:
python-tornado:
- Security fixes:
* CVE-2023-28370: Fixed an open redirect issue in the static file handler (bsc#1211741)
prometheus-blackbox_exporter:
- Use obscpio for go modules service
- Set version number
- Set build date from SOURCE_DATE_EPOCH
- Update to 0.24.0 (bsc#1212279, jsc#PED-4556)
* Requires go1.19
- Avoid empty validation script
- Add rc symlink for backwards compatibility
spacecmd:
- Version 4.3.22-1
* Bypass traditional systems check on older SUMA instances (bsc#1208612)