Security update for tor SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0941-1 Final 1 1 2021-06-29T08:06:38Z current 2021-06-29T08:06:38Z 2021-06-29T08:06:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tor This update for tor fixes the following issues: tor 0.4.5.9 * Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell (CVE-2021-34548, boo#1187322) * Detect more failure conditions from the OpenSSL RNG code (boo#1187323) * Resist a hashtable-based CPU denial-of-service attack against relays (CVE-2021-34549, boo#1187324) * Fix an out-of-bounds memory access in v3 onion service descriptor parsing (CVE-2021-34550, boo#1187325) tor 0.4.5.8 * https://lists.torproject.org/pipermail/tor-announce/2021-May/000219.html * allow Linux sandbox with Glibc 2.33 * work with autoconf 2.70+ * several other minor features and bugfixes (see announcement) - Fix logging issue due to systemd picking up stdout - boo#1181244 Continue to log notices to syslog by default. This update was imported from the openSUSE:Leap:15.2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-941 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/553MAZKSU2F6B7N6LTWA5YMHITLEL3HL/ E-Mail link for openSUSE-SU-2021:0941-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179331 SUSE Bug 1179331 https://bugzilla.suse.com/1181244 SUSE Bug 1181244 https://bugzilla.suse.com/1187322 SUSE Bug 1187322 https://bugzilla.suse.com/1187323 SUSE Bug 1187323 https://bugzilla.suse.com/1187324 SUSE Bug 1187324 https://bugzilla.suse.com/1187325 SUSE Bug 1187325 https://www.suse.com/security/cve/CVE-2021-34548/ SUSE CVE CVE-2021-34548 page https://www.suse.com/security/cve/CVE-2021-34549/ SUSE CVE CVE-2021-34549 page https://www.suse.com/security/cve/CVE-2021-34550/ SUSE CVE CVE-2021-34550 page SUSE Package Hub 15 SP2 tor-0.4.5.9-bp152.2.12.1 tor-0.4.5.9-bp152.2.12.1 as a component of SUSE Package Hub 15 SP2 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream. CVE-2021-34548 SUSE Package Hub 15 SP2:tor-0.4.5.9-bp152.2.12.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/553MAZKSU2F6B7N6LTWA5YMHITLEL3HL/ https://www.suse.com/security/cve/CVE-2021-34548.html CVE-2021-34548 https://bugzilla.suse.com/1187322 SUSE Bug 1187322 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency. CVE-2021-34549 SUSE Package Hub 15 SP2:tor-0.4.5.9-bp152.2.12.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/553MAZKSU2F6B7N6LTWA5YMHITLEL3HL/ https://www.suse.com/security/cve/CVE-2021-34549.html CVE-2021-34549 https://bugzilla.suse.com/1187324 SUSE Bug 1187324 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor CVE-2021-34550 SUSE Package Hub 15 SP2:tor-0.4.5.9-bp152.2.12.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/553MAZKSU2F6B7N6LTWA5YMHITLEL3HL/ https://www.suse.com/security/cve/CVE-2021-34550.html CVE-2021-34550 https://bugzilla.suse.com/1187325 SUSE Bug 1187325