MEDIUM6.1

PYSEC-2023-75

Quick fix

PYSEC-2023-75 — tornado: upgrade to the fixed version with the command below.

pip install --upgrade 'tornado>=6.3.2'

Details

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/tornado

Introduced in: 0Fixed in: 6.3.2

Fixpip install --upgrade 'tornado>=6.3.2'

References

https://jvn.jp/en/jp/JVN45127776/[WEB]
https://github.com/tornadoweb/tornado/releases/tag/v6.3.2[WEB]
https://github.com/advisories/GHSA-hj3f-6gcp-jg8j[ADVISORY]