Clarify affected versions re: 4.4.2 security fix

[dol-sen]

The release notes are not clear which versions are vulnerable for the cookie parser security fix.

quote: (older versions of Tornado would reject the entire header for a single invalid cookie)

Does that infer that only previous 4.4 releases were vulnerable? What about 4.2 and 4.3 releases, are any of those vulnerable? older...?

As a package maintainer, but not a tornado coder, I need to know the extent of the vulnerability. If I need to fastrack stabilization of the 4.4.2 release and remove which older versions, etc...

https://bugs.gentoo.org/show_bug.cgi?id=597740

Thank you.
Brian

[bdarnell]

Sorry for the slow response. I believe all prior versions are vulnerable; this is not specific to the 4.4 or even the 4.x series.