| Summary: | <net-vpn/tor-0.4.8.10: high severity issue in exit relays supporting conflux | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Federico Justus Denkena <federico.denkena> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | ajak, leohdz172, sam |
| Priority: | Normal | Keywords: | PullRequest |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: | https://github.com/gentoo/gentoo/pull/34188 | ||
| Whiteboard: | ~3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Federico Justus Denkena
2023-12-09 06:55:30 UTC
Major bugfixes (TROVE-2023-007, exit):
- Improper error propagation from a safety check in conflux leg
linking lead to a desynchronization of which legs were part of a
conflux set, ultimately causing a UAF and NULL pointer dereference
crash on Exit relays. Fixes bug 40897; bugfix on 0.4.8.1-alpha.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7aa526519c97de1127e0b98ed84fe7eef346c37b commit 7aa526519c97de1127e0b98ed84fe7eef346c37b Author: Federico Justus Denkena <federico.denkena@posteo.de> AuthorDate: 2023-12-09 09:34:30 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2023-12-09 18:06:10 +0000 net-vpn/tor: add 0.4.8.10 Bug: https://bugs.gentoo.org/919496 Signed-off-by: Federico Justus Denkena <federico.denkena@posteo.de> Closes: https://github.com/gentoo/gentoo/pull/34188 Signed-off-by: Sam James <sam@gentoo.org> net-vpn/tor/Manifest | 3 + net-vpn/tor/tor-0.4.8.10.ebuild | 177 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 180 insertions(+) ~arch -> noglsa The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0ac7454ec1e9bb9b859320cf3df6ee6fdf58c780 commit 0ac7454ec1e9bb9b859320cf3df6ee6fdf58c780 Author: Sam James <sam@gentoo.org> AuthorDate: 2023-12-09 18:11:49 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2023-12-09 18:12:33 +0000 net-vpn/tor: drop 0.4.8.9 Bug: https://bugs.gentoo.org/919496 Signed-off-by: Sam James <sam@gentoo.org> net-vpn/tor/Manifest | 3 - net-vpn/tor/tor-0.4.8.9.ebuild | 177 ----------------------------------------- 2 files changed, 180 deletions(-) |
