Source: salt X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security
Hi, The following vulnerability was published for Tornado, which is embedded by Salt: CVE-2023-28370[0]: | Open redirect vulnerability in Tornado versions 6.3.1 and earlier | allows a remote unauthenticated attacker to redirect a user to an | arbitrary web site and conduct a phishing attack by having user | access a specially crafted URL. https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f (v6.3.2) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-28370 https://www.cve.org/CVERecord?id=CVE-2023-28370 Please adjust the affected versions in the BTS as needed.
