openSUSE-SU-2021:0316-1

Security update for tor

No scoreFix available

openSUSE-SU-2021:0316-1 is a vulnerability with no CVSS score yet in tor, published February 20, 2021. No source lists public exploit code. Fixed in tor 0.4.5.6-lp152.2.6.1.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0.4.5.6-lp152.2.6.1tor

Description

This update for tor fixes the following issues:

tor was updated to 0.4.5.6:

https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.html
Introduce a new MetricsPort HTTP interface
Support IPv6 in the torrc Address option
Add event-tracing library support for USDT and LTTng-UST
Try to read N of N bytes on a TLS connection

tor was updated to 0.4.4.7:

https://blog.torproject.org/node/1990
Stop requiring a live consensus for v3 clients and services
Re-entry into the network is now denied at the Exit level
Fix undefined behavior on our Keccak library
Strip '\r' characters when reading text files on Unix platforms
Handle partial SOCKS5 messages correctly
Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)

Affected packages

Affected packages
Package	Affected	Fixed
`tor` openSUSE:Leap 15.2	before 0.4.5.6-lp152.2.6.1	0.4.5.6-lp152.2.6.1

What each source reports

OSVNo score

Security update for tor