CVE-2021-28090

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.

The dump_desc() function that we used to dump unparseable information to disk, was called incorrectly in several places, in a way that could lead to excessive CPU usage (CVE-2021-28089).

A bug in appending detached signatures to a pending consensus document could be used to crash a directory authority (CVE-2021-28090).

This update for tor fixes the following issues:

tor was updated to 0.4.5.7

• https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html
• Fix 2 denial of service security issues (boo#1183726)
  • Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089)
  • Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090)
• Ship geoip files based on the IPFire Location Database

This update for tor fixes the following issues:

tor was updated to 0.4.5.7

• https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html
• Fix 2 denial of service security issues (boo#1183726)
  • Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089)
  • Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090)
• Ship geoip files based on the IPFire Location Database

This update was imported from the openSUSE:Leap:15.2:Update update project.

These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.

It was discovered that Tor incorrectly handled certain memory operations. A remote attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-8955)

It was discovered that Tor did not properly handle the input length to dump_desc() function. A remote attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-28089)

It was discovered that Tor did not properly sanitize the relay nickname in dirvote_add_signatures_to_pending_consensus() function. An attacker could possibly use this issue to cause an assertion failure and then cause a denial of service. (CVE-2021-28090)

It was discovered that Tor did not properly validate the layer hint on half-open streams. A remote attacker could possibly use this issue to bypass the access control, leading to remote code execution. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-34548)

It was discovered that Tor was using an insecure hash function. A remote attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34549)

It was discovered that Tor did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted request, a remote attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly reading sensitive data. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34550)

It was discovered that Tor mishandles the relationship between batch-signature verification and single-signature verification. An attacker could possibly use this issue to cause an assertion failure and then cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-38385)