Tornado Regression — Ubuntu Security Update (USN-8952-3)
USN-8952-3 fixes a regression that USN-8952-2 itself introduced in the Tornado Python web framework. That update's incomplete fix could reject symlinks into system directories such as /usr/share — which distribution packages use for their JavaScript and fonts — so applications subclassing Tornado's StaticFileHandler, Jupyter being the prominent example, started returning 403 errors for web UI assets. This update corrects the problem while keeping the original security fixes (6 CVEs are listed, including CVE-2023-54397 and CVE-2024-14029).
Что это значит по лицензии SharedLicense
Affects servers running Tornado applications — Jupyter notebooks in particular — that received USN-8952-2: their static assets can break with 403s. The original advisory family is rated CVSS 7.5 with CWE-444 (inconsistent request handling) in this advisory's data, so apply 8952-3 rather than rolling back the security update.
USN-8952-2 fixed a regression in Tornado that broke static file serving
for applications that subclass Tornado’s StaticFileHandler, such as
Jupyter. Unfortunately, that update’s incomplete fix could introduce a regression by rejecting symlinks into system
directories like /usr/share, which distribution packages use for their
JavaScript and fonts, causing web UIs to return 403 errors. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)
Часто задаваемые вопросы
Why did my Jupyter or Tornado app start returning 403s?
Which Tornado flaws were fixed originally?
Do I need to restart the service after updating?
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему