Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7 & 8: 2021-0293 Critical: Tor Spoofing and DoS Threats

mageia
Calendar Grey June 28, 2021
Dist Mageia Esm H88
An important security patch for the firefox package on Fedora tackling various security flaws released on 15 Jul 2021.
Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on half-closed streams

Summary

Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on half-closed streams. Previously, clients failed to validate which hop sent these cells: this would allow a relay on a circuit to end a stream that wasn't actually built with it (CVE-2021-34548).
hashtable-based CPU denial-of-service attack against relays (CVE-2021-34549).
out-of-bounds memory access in v3 onion service descriptor parsing (CVE-2021-34550).
See also upstream release notes for included other bugfixes.
This package also fixes an error in tor package's un-install script (mga#29158).

References

- https://bugs.mageia.org/show_bug.cgi?id=29136

- https://bugs.mageia.org/show_bug.cgi?id=29158

- https://blog.torproject.org/new-stable-security-releases-03515-0449-0459-0465/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RST7YTNTKJURIR2QVIJMEBXWW2YHETRX/

- https://www.cve.org/CVERecord?id=CVE-2021-34548

- https://www.cve.org/CVERecord?id=CVE-2021-34549

- https://www.cve.org/CVERecord?id=CVE-2021-34550

Topics%20covered

Topics Covered

security advisory denial of service critical update memory access tor Mageia spoofing threat

Resolution

SRPMS

- 8/core/tor-0.3.5.15-1.1.mga8

- 7/core/tor-0.3.5.15-1.1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 28 Jun 2021
URL: https://advisories.mageia.org/MGASA-2021-0293.html
Type: security
CVE: CVE-2021-34548, CVE-2021-34549, CVE-2021-34550

Topics%20covered

Topics Covered

security advisory denial of service critical update memory access tor Mageia spoofing threat

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here