diff mbox series

[meta-python,wrynose,7/11] python3-tornado: patch CVE-2026-91991

Message ID 20260927003921.746786-7-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-networking,wrynose,1/11] unbound: patch CVE-2026-80225 | expand

Commit Message

Ankur Tyagi Sept. 27, 2026, 12:39 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport patch from v6.5.8 matching CVE description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-91991

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../python3-tornado/CVE-2026-91991.patch      | 57 +++++++++++++++++++
 .../python/python3-tornado_6.5.7.bb           |  1 +
 2 files changed, 58 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch
new file mode 100644
index 0000000000..6bd755af57
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch
@@ -0,0 +1,57 @@ 
+From 566a5ff64a530dfbc6bb6afbb1615c3e7addfd8d Mon Sep 17 00:00:00 2001
+From: Ben Darnell <ben@bendarnell.com>
+Date: Wed, 5 Aug 2026 21:33:26 -0400
+Subject: [PATCH] web: Also check for semicolons in deprecated mixed-case
+ cookie args
+
+(cherry picked from commit da284767eae8e1f0484f123b8c3225f6465b09c7)
+
+CVE: CVE-2026-91991
+Upstream-Status: Backport [https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ tornado/test/web_test.py | 12 ++++++++++++
+ tornado/web.py           |  6 ++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
+index 9bd1d49c..27e7fcfe 100644
+--- a/tornado/test/web_test.py
++++ b/tornado/test/web_test.py
+@@ -329,6 +329,18 @@ class CookieTest(WebTestCase):
+                                 "unexpected exception for char %r in domain: %s\n"
+                                 % (char, e)
+                             )
++                    try:
++                        self.set_cookie("foo", "bar", DoMaIn="example" + char + ".com")
++                        self.write(
++                            "Didn't get expected exception for char %r in DoMaIn\n"
++                            % char
++                        )
++                    except http.cookies.CookieError as e:
++                        if "Invalid cookie attribute DoMaIn" not in str(e):
++                            self.write(
++                                "unexpected exception for char %r in DoMaIn: %s\n"
++                                % (char, e)
++                            )
+ 
+                     try:
+                         self.set_cookie("foo", "bar", path="/" + char)
+diff --git a/tornado/web.py b/tornado/web.py
+index ec7ec3f5..6f1ae304 100644
+--- a/tornado/web.py
++++ b/tornado/web.py
+@@ -717,6 +717,12 @@ class RequestHandler:
+                 raise http.cookies.CookieError(
+                     f"Invalid cookie attribute {attr_name}={attr_value!r} for cookie {name!r}"
+                 )
++        for k, v in kwargs.items():
++            # Also check for disallowed characters in deprecated kwargs.
++            if re.search(r"[\x00-\x20\x3b\x7f]", str(v)):
++                raise http.cookies.CookieError(
++                    f"Invalid cookie attribute {k}={v!r} for cookie {name!r}"
++                )
+         if not hasattr(self, "_new_cookie"):
+             self._new_cookie = (
+                 http.cookies.SimpleCookie()
diff --git a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb
index ce7b903ef7..ca5b0a0470 100644
--- a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb
+++ b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb
@@ -10,6 +10,7 @@  SRC_URI[sha256sum] = "66c513a76cda70d53907bc27cf1447557699c2e95aa48ba27a442ff61c
 
 SRC_URI += "file://CVE-2026-91990.patch \
             file://CVE-2026-82397.patch \
+            file://CVE-2026-91991.patch \
 "
 
 inherit pypi python_setuptools_build_meta