Ubuntu fixes Tornado update that blocked symlinked static files
Original title: USN-8952-3: Tornado regression
USN-8952-3 corrects an incomplete fix that returned 403 errors for symlinks into directories such as /usr/share.
Ubuntu says USN-8952-2 fixed a Tornado regression that broke static file serving for applications subclassing StaticFileHandler, including Jupyter. That fix could reject symlinks into system directories such as /usr/share, which packages use for JavaScript and fonts, causing web UIs to return 403 errors. USN-8952-3 fixes that regression. The original notice said Tornado mishandled certain HTTP requests and network inputs.
Unconfirmed: The feed snippet cuts off the original advisory, so affected versions and CVE ids are not stated.
- The bad update could reject symlinks used by distribution packages.
- Affected web UIs could return 403 errors for JavaScript and fonts.
- The snippet cuts off before naming versions or CVE ids.
Impact: Possible denial of service, data exposure, or access bypass
| Product | Affected |
|---|---|
| Tornado | — |
- 1.Install the USN-8952-3 Tornado update.
From the original article
USN-8952-2 fixed a regression in Tornado that broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter. Unfortunately, that update's incomplete fix could introduce a regression by rejecting symlinks into system directories like /usr/share, which distribution packages use for their JavaScript and fonts, causing web UIs to return 403 errors. This update fixes the problem.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.