The regression is fixed in python-tornado 6.4.0-1ubuntu0.7 (noble),
6.5.4-0.1ubuntu0.3 (resolute) and 6.5.5-5ubuntu1.2 (stonking), released
today as part of USN-8952-2 (https://ubuntu.com/security/notices/USN-8952-2).
The fix declares allowed_symlink_directory as a class-level attribute and
resolves the allowed directory at the call site, so subclasses that override
StaticFileHandler.initialize() without calling the parent (such as
Jupyter's FileFindHandler) are no longer affected.
The ESM releases (jammy, focal, bionic, xenial) were also updated in the
same USN for users of Ubuntu Pro.
Thanks for reporting this issue.
** Changed in: python-tornado (Ubuntu)
Status: Confirmed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172317
Title:
python3-tornado 6.5.4-0.1ubuntu0.2 breaks Jupyter Notebook
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-tornado/+bug/2172317/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
