Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 678586 (CVE-2019-8955) - <net-vpn/tor-0.3.5.8: memory exhaustion in the KIST cell scheduler resulting in denial of service
Summary: <net-vpn/tor-0.3.5.8: memory exhaustion in the KIST cell scheduler resulting ...
Status: RESOLVED FIXED
Alias: CVE-2019-8955
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa cve]
Keywords:
: 678700 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-02-22 15:07 UTC by Agostino Sarubbo
Modified: 2019-03-24 13:37 UTC (History)
1 user (show)

See Also:
Package list:
net-vpn/tor-0.3.5.8
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2019-02-22 15:07:28 UTC 
From ${URL} :

In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor 
clients and relays can occur via memory exhaustion in the KIST cell scheduler.

References:
https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312 
https://trac.torproject.org/projects/tor/ticket/29168


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Anthony Basile gentoo-dev 2019-02-26 14:02:49 UTC 
*** Bug 678700 has been marked as a duplicate of this bug. ***
Comment 2 Anthony Basile gentoo-dev 2019-02-26 14:04:33 UTC 
@arch teams, please stabilize =net-vpn/tor-0.3.5.8

KEYWORDS="amd64 arm ppc ppc64 x86"
Comment 3 Agostino Sarubbo gentoo-dev 2019-02-26 17:44:52 UTC 
amd64 stable
Comment 4 Sergei Trofimovich (RETIRED) gentoo-dev 2019-02-27 08:47:53 UTC 
ppc stable
Comment 5 Sergei Trofimovich (RETIRED) gentoo-dev 2019-02-27 08:49:46 UTC 
ppc64 stable
Comment 6 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-02-28 15:37:16 UTC 
arm stable
Comment 7 Thomas Deutschmann (RETIRED) gentoo-dev 2019-03-01 01:19:44 UTC 
x86 stable
Comment 8 Anthony Basile gentoo-dev 2019-03-24 12:27:26 UTC 
The older versions are off the tree.