[SECURITY] Fedora 22 Update: python-tornado-3.2.2-1.fc22

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-9143
2015-05-30 09:30:49
--------------------------------------------------------------------------------

Name        : python-tornado
Product     : Fedora 22
Version     : 3.2.2
Release     : 1.fc22
URL         : http://www.tornadoweb.org
Summary     : Scalable, non-blocking web server and tools
Description :
Tornado is an open source version of the scalable, non-blocking web
server and tools.

The framework is distinct from most mainstream web server frameworks
(and certainly most Python frameworks) because it is non-blocking and
reasonably fast. Because it is non-blocking and uses epoll, it can
handle thousands of simultaneous standing connections, which means it is
ideal for real-time web services.

--------------------------------------------------------------------------------
Update Information:

Security fixes

    The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Backwards-compatibility notes

    If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers.
--------------------------------------------------------------------------------
ChangeLog:

* Tue May 19 2015 Thomas Spura <tomspur at fedoraproject.org> - 3.2.2-1
- Update to 3.2.2 to fix breack attack cve (#1222816,#1222819)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1222816 - CVE-2014-9720 python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH)
        https://bugzilla.redhat.com/show_bug.cgi?id=1222816
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use
su -c 'yum update python-tornado' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------