Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia: 2021-0181 Urgent: Tor Memory Flaw and Authority Failure

mageia
Calendar Grey April 12, 2021
Dist Mageia Esm H88
The recent Arch Linux security notice ALAS-2021-0123 highlights significant memory leaks and OpenVPN connectivity problems.
The dump_desc() function that we used to dump unparseable information to disk, was called incorrectly in several places, in a way that could lead to excessive CPU usage (CVE-2021-2...

Summary

The dump_desc() function that we used to dump unparseable information to disk, was called incorrectly in several places, in a way that could lead to excessive CPU usage (CVE-2021-28089).
A bug in appending detached signatures to a pending consensus document could be used to crash a directory authority (CVE-2021-28090).

References

- https://bugs.mageia.org/show_bug.cgi?id=28628

- https://blog.torproject.org/new-releases-with-security-fixes-tor-03514-0448-and-0457/

- https://www.cve.org/CVERecord?id=CVE-2021-28089

- https://www.cve.org/CVERecord?id=CVE-2021-28090

Topics%20covered

Topics Covered

security advisory critical issue Tor Mageia CPU issue authority crash

Resolution

SRPMS

- 7/core/tor-0.3.5.14-1.mga7

- 8/core/tor-0.3.5.14-1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 12 Apr 2021
URL: https://advisories.mageia.org/MGASA-2021-0180.html
Type: security
CVE: CVE-2021-28089, CVE-2021-28090

Topics%20covered

Topics Covered

security advisory critical issue Tor Mageia CPU issue authority crash

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here