Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2023-54397

Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

CVSS 4.0 9.0 CRITICALCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2023-54397

Published

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2023-54397

Published

tornado

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "tornadoweb",
                    "product": "tornado",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:pypi/tornado",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "6.3.3"
                        },
                        {
                            "version": "6.3.3",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON