QSN-8952-1: Tornado vulnerabilities
2026-10-22

Summary:
Tornado could be made to crash or expose sensitive information if it
received specially crafted network traffic.

Details:
It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.9.0.464 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.6.015 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.5.018 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.4.038 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.3.018 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.2.002 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.1.007 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)
  6.8.0.205 jammy: python3-tornado 6.1.0-3ubuntu0.1~esm2 (fixed in 6.1.0-3ubuntu0.1~esm6)

CVEs: CVE-2026-103263, CVE-2024-14029, CVE-2023-54397, CVE-2026-91992, CVE-2026-91990, CVE-2026-103262

References:
  https://ubuntu.com/security/notices/USN-8952-1