Ubuntu releases fix for Tornado regression affecting static file serving and symlinks

Canonical has issued USN-8952-3 to resolve a regression within the Tornado web framework on Ubuntu systems. This specific issue arose following a previous attempt to fix vulnerabilities that inadvertently broke static file serving for applications subclassing Tornado's StaticFileHandler.

The regression specifically impacted applications like Jupyter by rejecting symlinks pointing into system directories such as /usr/share. This caused web interfaces to return 403 Forbidden errors when attempting to load essential assets like fonts and JavaScript files. This update restores proper handling of these file paths while maintaining security fixes for several identified CVEs.

Technical details of the Tornado regression

• Subsystem/Feature: The fix addresses a failure in the StaticFileHandler subclassing mechanism where symlinks to system-level directories were incorrectly rejected.
• Security Context: This update follows previous patches for multiple vulnerabilities (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263) related to denial of service and access control bypasses.
• Affected Assets: The regression primarily disrupted the loading of JavaScript and font files located in /usr/share, which are frequently accessed via symlinks in web-based development environments.
• Impacted Software: Applications that rely on Tornado's static file handling, most notably Jupyter, were identified as being susceptible to the 403 error behavior.

Why it matters

This update is critical for developers and system administrators using Ubuntu-based environments for data science or web development, as it restores functionality to tools like Jupyter. It highlights the complexity of balancing security hardening against the functional requirements of standard Linux filesystem structures like symlinks in /usr/share.