Critical Vulnerability in Python Tornado: Excessive CPU Consumption Due to Cookie Parsing
Summary
UBUNTU-CVE-2024-52804: Tornado is a Python web framework and asynchronous networking library. Affects python-tornado versions < 4.5.3-1ubuntu0.2+esm1. Fixed in 4.5.3-1ubuntu0.2+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Tornado is a powerful web framework and asynchronous networking library designed for building scalable web applications. It is known for its non-blocking network I/O and ability to handle thousands of simultaneous connections. However, certain versions of Tornado have a vulnerability in their HTTP cookie parsing mechanism, which can lead to performance issues under specific conditions.
Vulnerability Detail
The vulnerability in Tornado arises from the algorithm used for parsing HTTP cookies in versions prior to 6.4.2. This algorithm exhibits quadratic complexity, which means that when processing maliciously-crafted cookie headers, it can lead to excessive CPU consumption. This excessive load occurs in the event loop thread, potentially blocking the processing of other requests and degrading the performance of the web application. The vulnerability is identified as CVE-2024-52804 and has a CVSS score of 7.5, indicating a medium severity level.
How To Fix
Minimum fixed version
4.5.3-1ubuntu0.2+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on cookie headers or validating cookie sizes to prevent excessively large or complex cookies from being processed.
Conclusion
The vulnerability in Python Tornado, identified as CVE-2024-52804, poses a significant risk due to its potential to cause excessive CPU consumption through inefficient cookie parsing. Users are strongly advised to update to version 6.4.2 or higher to mitigate this risk. Additionally, temporary workarounds can be implemented until the update is applied.
See every vulnerability recorded for python-tornado →
FAQ
CVE-2024-52804 is a vulnerability in the Python Tornado framework that can lead to excessive CPU consumption when parsing maliciously-crafted HTTP cookie headers.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any installation.
Versions of Tornado prior to 6.4.2 are affected by this vulnerability. It is recommended to upgrade to version 6.4.2 or higher.
The vulnerability can lead to excessive CPU usage, which may block the processing of other requests, resulting in degraded application performance and user experience.
Yes, you can implement rate limiting on cookie headers or validate cookie sizes to prevent processing of overly complex cookies as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python-tornado.
