CVE-2021-38385

Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.

Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.

Henry de Valence reported a flaw in the signature verification code in Tor, a connection-based low-latency anonymous communication system. A remote attacker can take advantage of this flaw to cause an assertion failure, resulting in denial of service.

This update for tor fixes the following issues:

tor 0.4.6.7:

• Fix a DoS via a remotely triggerable assertion failure (boo#1189489, TROVE-2021-007, CVE-2021-38385)

tor 0.4.6.6:

• Fix a compilation error with gcc 7, drop tor-0.4.6.5-gcc7.patch
• Enable the deterministic RNG for unit tests that covers the address set bloomfilter-based API's

tor 0.4.6.5

• Add controller support for creating v3 onion services with client auth
• When voting on a relay with a Sybil-like appearance, add the Sybil flag when clearing out the other flags. This lets a relay operator know why their relay hasn't been included in the consensus
• Relays now report how overloaded they are
• Add a new DoS subsystem to control the rate of client connections for relays
• Relays now publish statistics about v3 onions services
• Improve circuit timeout algorithm for client performance

This update for tor fixes the following issues:

tor 0.4.6.7:

• Fix a DoS via a remotely triggerable assertion failure (boo#1189489, TROVE-2021-007, CVE-2021-38385)

tor 0.4.6.6:

• Fix a compilation error with gcc 7, drop tor-0.4.6.5-gcc7.patch
• Enable the deterministic RNG for unit tests that covers the address set bloomfilter-based API's

tor 0.4.6.5

• Add controller support for creating v3 onion services with client auth
• When voting on a relay with a Sybil-like appearance, add the Sybil flag when clearing out the other flags. This lets a relay operator know why their relay hasn't been included in the consensus
• Relays now report how overloaded they are
• Add a new DoS subsystem to control the rate of client connections for relays
• Relays now publish statistics about v3 onions services
• Improve circuit timeout algorithm for client performance

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for tor fixes the following issues:

tor 0.4.6.7:

• Fix a DoS via a remotely triggerable assertion failure (boo#1189489, TROVE-2021-007, CVE-2021-38385)

tor 0.4.6.6:

• Enable the deterministic RNG for unit tests that covers the address set bloomfilter-based API's

tor 0.4.6.5

• Add controller support for creating v3 onion services with client auth
• When voting on a relay with a Sybil-like appearance, add the Sybil flag when clearing out the other flags. This lets a relay operator know why their relay hasn't been included in the consensus
• Relays now report how overloaded they are
• Add a new DoS subsystem to control the rate of client connections for relays
• Relays now publish statistics about v3 onions services
• Improve circuit timeout algorithm for client performance

These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.

It was discovered that Tor incorrectly handled certain memory operations. A remote attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-8955)

It was discovered that Tor did not properly handle the input length to dump_desc() function. A remote attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-28089)

It was discovered that Tor did not properly sanitize the relay nickname in dirvote_add_signatures_to_pending_consensus() function. An attacker could possibly use this issue to cause an assertion failure and then cause a denial of service. (CVE-2021-28090)

It was discovered that Tor did not properly validate the layer hint on half-open streams. A remote attacker could possibly use this issue to bypass the access control, leading to remote code execution. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-34548)

It was discovered that Tor was using an insecure hash function. A remote attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34549)

It was discovered that Tor did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted request, a remote attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly reading sensitive data. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34550)

It was discovered that Tor mishandles the relationship between batch-signature verification and single-signature verification. An attacker could possibly use this issue to cause an assertion failure and then cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-38385)