[Bug]: Patch bundled tornado for CVE-2026-49853 (Authorization/Cookie header leak on cross-origin redirect)

What happened?

Summary

Salt vendors tornado at salt/ext/tornado, pinned to 4.5.3 with manually
backported security fixes (see salt/ext/tornado/__init__.py, currently
marked "patched for CVEs up to 6.5.5"). Tornado 6.5.6 fixed CVE-2026-49853,
and the vulnerable code exists in our bundled copy.

Vulnerability

CVE-2026-49853 (GHSA-3x9g-8vmp-wqvf, CVSS 7.7 High)

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the
original HTTPRequest, rewrites the URL, and removes only the Host
header. It does not clear Authorization, auth_username, auth_password,
or the Cookie header when the redirect target changes origin. Since
follow_redirects=True is the default, credentials intended for one origin
(e.g. a Bearer token or Basic auth credentials) can be forwarded to an
attacker-controlled origin via a redirect chain.

Confirmed present in salt/ext/tornado/simple_httpclient.py,
_HTTPConnection.finish().

Fix

Upstream's fix (tornado 6.5.6) matches libcurl's default behavior: when a
redirect changes the scheme, host, or port, strip Authorization and
Cookie headers, and clear auth_username/auth_password, before
following the redirect.

Type of salt install

Official deb

Major version

3006.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

amazonlinux-2

salt --versions-report output

3006.x