Patch · 1 source · latest 3h

Ubuntu fixes Tornado update that broke static file serving in Jupyter

PATCHUbunturedteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

Ubuntu USN-8952-2 addresses a regression introduced by USN-8952-1 for Tornado. The earlier update contained an incomplete fix for CVE-2026-103263, which broke static file serving in applications subclassing StaticFileHandler, including Jupyter. The original advisory covers CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262 and CVE-2026-103263, which the advisory says could allow denial of service, sensitive information exposure or access control bypass. Affected versions are not stated in the source. Defenders running Tornado on Ubuntu should apply USN-8952-2 rather than stopping at USN-8952-1, and check any Jupyter or other StaticFileHandler-based services after patching.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Install the Ubuntu USN-8952-2 Tornado update, which replaces the incomplete USN-8952-1 fix.
Check that static file serving works in any Jupyter or other Tornado application after updating.

Written by AI from the sources, checked against them

Read the full story at the source