openSUSE-SU-2021:0334-1 Security update for tor
An attacker can cause denial of service or bypass security checks in Tor relays due to improper channel and circuit validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2021:0334-1?
openSUSE-SU-2021:0334-1 is a vulnerability in tor, published on 23 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for tor fixes the following issues:
tor was updated to 0.4.5.6:
- https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.html
- Introduce a new MetricsPort HTTP interface
- Support IPv6 in the torrc Address option
- Add event-tracing library support for USDT and LTTng-UST
- Try to read N of N bytes on a TLS connection
tor was updated to 0.4.4.7:
Stop requiring a live consensus for v3 clients and services
Re-entry into the network is now denied at the Exit level
Fix undefined behavior on our Keccak library
Strip '\r' characters when reading text files on Unix platforms
Handle partial SOCKS5 messages correctly
Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)
This update was imported from the openSUSE:Leap:15.2:Update update project.
Which versions are affected by openSUSE-SU-2021:0334-1?
Linux distribution packages (1)
tor SUSE:Package Hub 15 SP2 | All versions | 0.4.5.6-bp152.2.6.1 |
How do I fix openSUSE-SU-2021:0334-1?
Upgrade to a fixed version.
Is openSUSE-SU-2021:0334-1 being exploited?
There is no known exploitation of openSUSE-SU-2021:0334-1 in the wild and no public exploit code.