search

canonical / snapcraft

Package, distribute, and update any app for Linux and IoT.
https://snapcraft.io
GNU General Public License v3.0
1.18k stars 447 forks source link

build(deps): update dependency tornado to v6.4.2 [security] (hotfix/7.5) #5153

Open renovate[bot] opened 3 days ago

renovate[bot] commented 3 days ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
tornado (source) ==6.2 -> ==6.4.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-52804

The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.

See also CVE-2024-7592 for a similar vulnerability in cpython.

Release Notes

tornadoweb/tornado (tornado) ### [`v6.4.2`](https://redirect.github.com/tornadoweb/tornado/compare/v6.4.1...v6.4.2) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.4.1...v6.4.2) ### [`v6.4.1`](https://redirect.github.com/tornadoweb/tornado/compare/v6.4.0...v6.4.1) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.4.0...v6.4.1) ### [`v6.4`](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.3...v6.4.0) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.3...v6.4.0) ### [`v6.3.3`](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.2...v6.3.3) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.2...v6.3.3) ### [`v6.3.2`](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.1...v6.3.2) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.1...v6.3.2) ### [`v6.3.1`](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.0...v6.3.1) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.3.0...v6.3.1) ### [`v6.3`](https://redirect.github.com/tornadoweb/tornado/compare/v6.2.0...v6.3.0) [Compare Source](https://redirect.github.com/tornadoweb/tornado/compare/v6.2.0...v6.3.0)

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.