openSUSE-SU-2021:0316-1 Security update for tor
An update to Tor fixes undefined behavior in Keccak and improves relay circuit checks, preventing potential crashes or network manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2021:0316-1?
openSUSE-SU-2021:0316-1 is a vulnerability in tor, published on 20 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for tor fixes the following issues:
tor was updated to 0.4.5.6:
- https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.html
- Introduce a new MetricsPort HTTP interface
- Support IPv6 in the torrc Address option
- Add event-tracing library support for USDT and LTTng-UST
- Try to read N of N bytes on a TLS connection
tor was updated to 0.4.4.7:
Stop requiring a live consensus for v3 clients and services
Re-entry into the network is now denied at the Exit level
Fix undefined behavior on our Keccak library
Strip '\r' characters when reading text files on Unix platforms
Handle partial SOCKS5 messages correctly
Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)
Which versions are affected by openSUSE-SU-2021:0316-1?
Linux distribution packages (1)
tor openSUSE:Leap 15.2 | All versions | 0.4.5.6-lp152.2.6.1 |
How do I fix openSUSE-SU-2021:0316-1?
Upgrade to a fixed version.
Is openSUSE-SU-2021:0316-1 being exploited?
There is no known exploitation of openSUSE-SU-2021:0316-1 in the wild and no public exploit code.