{"id":"MGASA-2026-0489","aliases":[],"status":"published","title":"Updated tor package fixes security vulnerabilities","description":"This update fixes security issues:\n- Only accept a CONFLUX_LINK cell on a plain OR circuit, and refuse to\nturn a (pending) conflux leg into an introduction or rendezvous point.\nPreviously a client could link a rendezvous-point circuit into a conflux\nset and then, with a forged sequence number in the LINK cell, make the\nrelay tear the set down from inside the rendezvous splice, triggering a\nfatal assertion in assert_circuit_ok(). Also reject a LINK/LINKED cell\nwhose last_seqno_recv is above what we ever sent on the set.\n- Correctly copy the MiddleOnly flag from routerstatuses to node\nobjects.\nWithout this fix, the MiddleOnly flag was ignored on non-authorities,\nand\nclients could use MiddleOnly relays for inappropriate roles in onion\nservice circuits. Tracked as TROVE-2026-067.\n- Treat a router descriptor as expired if any of its family certificates\nhas expired. Previously, we incorrectly ignored the expiration time of\nthe family certificate. Tracked as TROVE-2026-062.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:00:44Z","fixes":[{"ecosystem":"Mageia:10","package":"tor","fixed_in":["0.4.9.14-1.mga10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.14-1.mga10"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0489.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36473","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/07/33","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2026-0489","title":"Updated tor package fixes security vulnerabilities","description":"This update fixes security issues:\n- Only accept a CONFLUX_LINK cell on a plain OR circuit, and refuse to\nturn a (pending) conflux leg into an introduction or rendezvous point.\nPreviously a client could link a rendezvous-point circuit into a conflux\nset and then, with a forged sequence number in the LINK cell, make the\nrelay tear the set down from inside the rendezvous splice, triggering a\nfatal assertion in assert_circuit_ok(). Also reject a LINK/LINKED cell\nwhose last_seqno_recv is above what we ever sent on the set.\n- Correctly copy the MiddleOnly flag from routerstatuses to node\nobjects.\nWithout this fix, the MiddleOnly flag was ignored on non-authorities,\nand\nclients could use MiddleOnly relays for inappropriate roles in onion\nservice circuits. Tracked as TROVE-2026-067.\n- Treat a router descriptor as expired if any of its family certificates\nhas expired. Previously, we incorrectly ignored the expiration time of\nthe family certificate. Tracked as TROVE-2026-062.\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:00:44.448138879Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}