The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-2471 advisory.

    [0.11.8-1.el9_5.2]
    - Fixed CVE-2024-52804 by patching bundled Tornado       Resolves: RHEL-81924

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-2872 advisory.

    [0.10.18-2.0.1.el8_10.4]
    - Replace HAM-logo.png with a generic one

    [0.10.18-2.el8_10.4]
    - Fixed CVE-2024-52804 by patching bundled Tornado       Resolves: RHEL-81924

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-10590 advisory.

    [6.4.2-1]
    - Update to 6.4.2       Resolves: RHEL-68663

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0813 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-52804:
    Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP     cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU     consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread     and may block the processing of other requests. Version 6.4.2 fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-792 advisory.

    Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP     cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU     consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread     and may block the processing of other requests. Version 6.4.2 fixes the issue. (CVE-2024-52804)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2725 advisory.

    Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP     cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU     consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread     and may block the processing of other requests. Version 6.4.2 fixes the issue. (CVE-2024-52804)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2471 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:10590 advisory.

    Tornado is a Python web framework and asynchronous networking library that provides an open source version     of scalable, non-blocking web server and tools.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0999 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-52804:
    Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP     cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU     consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread     and may block the processing of other requests. Version 6.4.2 fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7150-1 advisory.

    It was discovered that Tornado incorrectly handled a certain redirect. A remote attacker could possibly     use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having the     user access a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 20.04 LTS,     and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously addressed in USN-6159-1. (CVE-2023-28370)

    It was discovered that Tornado inefficiently handled requests when parsing cookies. An attacker could     possibly use this issue to increase resource utilization leading to a denial of service. (CVE-2024-52804)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
232664	Oracle Linux 9 : pcs (ELSA-2025-2471)	Nessus	Oracle Linux Local Security Checks	2025/3/12	2025/9/11	high
232983	Oracle Linux 8 : pcs (ELSA-2025-2872)	Nessus	Oracle Linux Local Security Checks	2025/3/20	2025/9/11	high
211996	Oracle Linux 9 : python-tornado (ELSA-2024-10590)	Nessus	Oracle Linux Local Security Checks	2024/12/2	2025/9/9	high
271106	TencentOS Server 3: pcs (TSSA-2025:0813)	Nessus	Tencent Local Security Checks	2025/10/22	2025/12/4	high
213666	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-792)	Nessus	Amazon Linux Local Security Checks	2025/1/9	2025/1/9	high
213671	Amazon Linux 2 : python3-tornado (ALAS-2025-2725)	Nessus	Amazon Linux Local Security Checks	2025/1/9	2025/1/9	high
232793	RHEL 9 : pcs (RHSA-2025:2471)	Nessus	Red Hat Local Security Checks	2025/3/15	2025/6/5	high
211988	RHEL 9 : python-tornado (RHSA-2024:10590)	Nessus	Red Hat Local Security Checks	2024/12/2	2025/3/10	high
239754	TencentOS Server 4: python-tornado (TSSA-2024:0999)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
212409	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Tornado vulnerabilities (USN-7150-1)	Nessus	Ubuntu Local Security Checks	2024/12/11	2024/12/11	medium

检测

插件搜索

high

high

high

high

high

high

high

high

high

medium