遠端 Oracle Linux 9 主機上安裝的一個套件受到 ELSA-2023-6523 公告中提及的弱點影響。

  - Tornado 6.3.1 版和更舊版本中存在開放重新導向弱點，未經驗證的遠端攻擊者可藉此透過讓使用者存取特製的 URL，將使用者重新導向至任意網站並發動網路釣魚攻擊。(CVE-2023-28370)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Tornado 6.3.1 版和更舊版本中存在開放重新導向弱點，未經驗證的遠端攻擊者可藉此透過讓使用者存取特製的 URL，將使用者重新導向至任意網站並發動網路釣魚攻擊。(CVE-2023-28370)

請注意，Nessus 依賴供應商報告的套件存在。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3144-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3123-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3131-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4007 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4007-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     January 01, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-tornado     Version        : 6.1.0-1+deb11u1     CVE ID         : CVE-2023-28370 CVE-2024-52804     Debian Bug     : 1036875 1088112

    Tornado is a scalable, non-blocking Python web framework and     asynchronous networking library.

    CVE-2023-28370

        An open redirect vulnerability in Tornado versions 6.3.1 and earlier allows         a remote unauthenticated attacker to redirect a user to an arbitrary web         site and conduct a phishing attack by having the user access a specially         crafted URL.

    CVE-2024-52804

        The algorithm used for parsing HTTP cookies in Tornado versions prior to         6.4.2 sometimes has quadratic complexity, leading to excessive CPU         consumption when parsing maliciously-crafted cookie headers. This         parsing occurs in the event loop thread and may block the processing of         other requests.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.0-1+deb11u1.

    We recommend that you upgrade your python-tornado packages.

    For the detailed security status of python-tornado please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-tornado

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
185837	Oracle Linux 9：python-tornado (ELSA-2023-6523)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	medium
250426	Linux Distros 未修補的弱點：CVE-2023-28370	Nessus	Misc.	2025/8/18	2025/10/28	medium
179304	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:3144-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
179293	SUSE SLES15 Security Update : salt (SUSE-SU-2023:3123-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
179296	SUSE SLES15 Security Update : salt (SUSE-SU-2023:3131-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
213445	Debian dla-4007 : python-tornado-doc - security update	Nessus	Debian Local Security Checks	2025/1/1	2025/1/1	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium