CVE-2014-9720: CSRF
From http://www.tornadoweb.org/en/stable/releases/v3.2.2.html
Security fixes
The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrfcookies and gzip options (or have gzip applied by a proxy).
Backwards-compatibility notes
If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrfcookieversion=1 can be used for a transitional period to generate the older cookie format on newer servers.
Upstream patch: https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308
Other sources
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9720?
CVE-2014-9720 has a medium severity rating due to its potential impact on the security of XSRF tokens.
How do I fix CVE-2014-9720?
To fix CVE-2014-9720, upgrade to Tornado version 3.2.2 or later.
What does CVE-2014-9720 affect?
CVE-2014-9720 affects Tornado versions prior to 3.2.2 and specifically involves vulnerabilities in XSRF token handling.
What is the main issue addressed by CVE-2014-9720?
CVE-2014-9720 addresses an issue with XSRF token encoding that could be exploited in certain scenarios.
Is CVE-2014-9720 present in later versions of Tornado?
No, CVE-2014-9720 is not present in Tornado version 3.2.2 and later due to the implemented security enhancements.