Ubuntu: Security Patch for Critical XSS Vulnerability CVE-2023

This update for python-tornado6 fixes the following issues: * CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903). * CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add` method can lead to DoS when processing a maliciously crafted HTTP request (bsc#1254905). * CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can lead to DoS when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-10=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-10=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-10=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-10=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-10=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-10=1 * SUSE Linux Enterprise Server for SAP Read the Full Advisory

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-10=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-10=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-10=1

* SUSE Linux Enterprise Server 15 SP4 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-10=1

* SUSE Linux Enterprise Server 15 SP5 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-10=1

* SUSE Linux Enterprise Server 15 SP6 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-10=1

* SUSE Linux Enterprise Server for SAP

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * python311-tornado6-6.3.2-150400.9.12.1 * python-tornado6-debugsource-6.3.2-150400.9.12.1 * python311-tornado6-debuginfo-6.3.2-150400.9.12.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * python311-tornado6-6.3.2-150400.9.12.1 * python-tornado6-debugsource-6.3.2-150400.9.12.1 * python311-tornado6-debuginfo-6.3.2-150400.9.12.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * python311-tornado6-6.3.2-150400.9.12.1 * python-tornado6-debugsource-6.3.2-150400.9.12.1 * python311-tornado6-debuginfo-6.3.2-150400.9.12.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * python311-tornado6-6.3.2-150400.9.12.1 * python-tornado6-debugsource-6.3.2-150400.9.12.1 * python311-tornado6-debuginfo-6.3.2-150400.9.12.1 * SUSE Linux Enterprise Server 15 SP5 LTSS Read the Full Advisory

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64

* python311-tornado6-6.3.2-150400.9.12.1

* python-tornado6-debugsource-6.3.2-150400.9.12.1

* python311-tornado6-debuginfo-6.3.2-150400.9.12.1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64

* python311-tornado6-6.3.2-150400.9.12.1

* python-tornado6-debugsource-6.3.2-150400.9.12.1

* python311-tornado6-debuginfo-6.3.2-150400.9.12.1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64

* python311-tornado6-6.3.2-150400.9.12.1

* python-tornado6-debugsource-6.3.2-150400.9.12.1

* python311-tornado6-debuginfo-6.3.2-150400.9.12.1

* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)

* python311-tornado6-6.3.2-150400.9.12.1

* python-tornado6-debugsource-6.3.2-150400.9.12.1

* python311-tornado6-debuginfo-6.3.2-150400.9.12.1

* SUSE Linux Enterprise Server 15 SP5 LTSS

* bsc#1254903 * bsc#1254904 * bsc#1254905 ## References: * * * * * *

*

*

*

*

*

*