Bug 930362 (CVE-2014-9720) - VUL-1: CVE-2014-9720: python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH)
Summary: VUL-1: CVE-2014-9720: python-tornado: XSRF cookie allows side-channel attack ...
Status: RESOLVED FIXED
Alias: CVE-2014-9720
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:RedHat:CVE-2014-9720:4.3:(AV:N...
Keywords:
Depends on:
Blocks: CVE-2013-3587
  Show dependency treegraph
 
Reported: 2015-05-11 08:29 UTC by Andreas Stieger
Modified: 2017-01-23 13:37 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
fix patch (14.49 KB, patch)
2015-10-27 06:41 UTC, Cliff Zhao
Details | Diff
the patch (14.45 KB, patch)
2015-11-02 10:07 UTC, Cliff Zhao
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-05-11 08:29:35 UTC
From http://www.tornadoweb.org/en/stable/releases/v3.2.2.html

Security fixes

    The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Backwards-compatibility notes

    If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers.




Also see bug 833754 for BREACH.

References:
From http://www.tornadoweb.org/en/stable/releases/v3.2.2.html
http://breachattack.com/
Comment 1 Swamp Workflow Management 2015-05-11 22:00:23 UTC
bugbot adjusting priority
Comment 3 Andreas Stieger 2015-05-20 08:49:24 UTC
CVE-2014-9720 assigned http://seclists.org/oss-sec/2015/q2/501
Comment 4 Vincent Untz 2015-10-19 12:45:51 UTC
Alexandre, on top of bug 930361, there's also this one.
Comment 5 Cliff Zhao 2015-10-26 04:51:13 UTC
This request need to porting patches:
1,Small security improvements to xsrf tokens; add tests.  
https://github.com/tornadoweb/tornado/commit/7279a303d1c366aabd4facfc6b29ed46c3422350
2,Change the xsrf cookie format to be masked with a random salt. 
https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308
3,Add the option to request an older xsrf cookie version. 
https://github.com/tornadoweb/tornado/commit/c2a8c322b3f3f54f6525d7469ecab1af46862bc2
Comment 6 Cliff Zhao 2015-10-27 06:41:21 UTC
Created attachment 653293 [details]
fix patch

this patch which merge xsrf request.
Comment 7 Cliff Zhao 2015-10-29 08:42:13 UTC
Request 76763 Got accepted
Maintenance target got moved to project SUSE:Maintenance:1369
Bug fixed.
https://build.suse.de/request/show/76763
Comment 8 Cliff Zhao 2015-11-02 10:07:17 UTC
Created attachment 654143 [details]
the patch

This patch is for openSUSE-13.1
Patch re write on tornado-3.1.0
Code request on:
https://api.opensuse.org/request/show/342032
Comment 9 Swamp Workflow Management 2015-11-16 10:13:44 UTC
openSUSE-SU-2015:1998-1: An update that solves one vulnerability and has one errata is now available.

Category: security (low)
Bug References: 930361,930362
CVE References: CVE-2014-9720
Sources used:
openSUSE 13.1 (src):    python-tornado-3.1-2.3.1
Comment 10 Swamp Workflow Management 2016-05-02 16:08:15 UTC
SUSE-SU-2016:1195-1: An update that solves one vulnerability and has two fixes is now available.

Category: security (moderate)
Bug References: 930361,930362,974657
CVE References: CVE-2014-9720
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    python-backports.ssl_match_hostname-3.4.0.2-15.1, python-tornado-4.2.1-11.1
SUSE Linux Enterprise Workstation Extension 12 (src):    python-backports.ssl_match_hostname-3.4.0.2-15.1, python-tornado-4.2.1-11.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    python-backports.ssl_match_hostname-3.4.0.2-15.1, python-tornado-4.2.1-11.1
SUSE Linux Enterprise Desktop 12 (src):    python-backports.ssl_match_hostname-3.4.0.2-15.1, python-tornado-4.2.1-11.1
Comment 11 Johannes Segitz 2017-01-23 13:37:29 UTC
all released