CVE-2025-67724

{"id": "CVE-2025-67724", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67724", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T18:53:21.062311Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tornadoweb", "product": "tornado", "versions": [{"status": "affected", "version": "< 6.5.3"}]}]}], "published": "2025-12-12T06:15:41.213", "references": [{"url": "https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/releases/tag/v6.5.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-644"}]}], "descriptions": [{"lang": "en", "value": "Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom \"reason\" phrases (the \"Not Found\" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3."}, {"lang": "es", "value": "Tornado es un framework web de Python y una biblioteca de red as\u00edncrona. En las versiones 6.5.2 e inferiores, la frase de motivo proporcionada se utiliza sin escapar en los encabezados HTTP (donde podr\u00eda usarse para inyecci\u00f3n de encabezados) o en HTML en la p\u00e1gina de error predeterminada (donde podr\u00eda usarse para XSS) y puede ser explotada al pasar datos no confiables o maliciosos al argumento reason. Utilizado tanto por RequestHandler.set_status como por tornado.web.HTTPError, el argumento est\u00e1 dise\u00f1ado para permitir que las aplicaciones pasen frases de 'motivo' personalizadas (el 'Not Found' en HTTP/1.1 404 Not Found) a la l\u00ednea de estado HTTP (principalmente para c\u00f3digos de estado no est\u00e1ndar). Este problema se soluciona en la versi\u00f3n 6.5.3."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64279E50-159B-4CAB-9BD0-E2B764C3C40C", "versionEndExcluding": "6.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}