Bug 916759 (TROVE-2023-004) – <net-vpn/tor-{0.4.7.16, 0.4.8.8}: Denial of service when built against dev-libs/openssl

• Product: Gentoo Security
• Status: IN_PROGRESS ---

[Description Sam James 2023-11-03 15:36:52 UTC]

See https://gitlab.torproject.org/tpo/core/tor/-/commit/7aa496a2e057bb7c3cc284a04a1a4d2941c304f1.

  o Major bugfixes (TROVE-2023-004, relay):
    - Mitigate an issue when Tor compiled with OpenSSL can crash during
      handshake with a remote relay. Fixes bug 40874; bugfix on 0.2.7.2-alpha.

[Comment 1 Larry the Git Cow 2023-11-03 15:39:12 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9b0f69c9bf89f33e458a0d6e07fa11b847742666

commit 9b0f69c9bf89f33e458a0d6e07fa11b847742666
Author:     Sam James <[e-mail]>
AuthorDate: 2023-11-03 15:38:04 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-11-03 15:38:26 +0000

    net-vpn/tor: add 0.4.8.8
    
    Bug: https://bugs.gentoo.org/916759
    Signed-off-by: Sam James <[e-mail]>

 net-vpn/tor/Manifest           |   3 +
 net-vpn/tor/tor-0.4.8.8.ebuild | 177 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 180 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f232b4efc5f1bfb9068b808527197e357f505c70

commit f232b4efc5f1bfb9068b808527197e357f505c70
Author:     Sam James <[e-mail]>
AuthorDate: 2023-11-03 15:33:44 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-11-03 15:38:17 +0000

    net-vpn/tor: add 0.4.7.16
    
    Bug: https://bugs.gentoo.org/916759
    Signed-off-by: Sam James <[e-mail]>

 net-vpn/tor/Manifest            |   3 +
 net-vpn/tor/tor-0.4.7.16.ebuild | 167 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 170 insertions(+)