openSUSE Security Update: Security update for tor

Announcement ID:    openSUSE-SU-2021:0926-1
Rating:             important
References:         #1179331 #1181244 #1187322 #1187323 #1187324 
Cross-References:   CVE-2021-34548 CVE-2021-34549 CVE-2021-34550
Affected Products:
                    openSUSE Leap 15.2

   An update that solves three vulnerabilities and has three
   fixes is now available.


   This update for tor fixes the following issues:


   * Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell
     (CVE-2021-34548, boo#1187322)
   * Detect more failure conditions from the OpenSSL RNG code (boo#1187323)
   * Resist a hashtable-based CPU denial-of-service attack against relays
     (CVE-2021-34549, boo#1187324)
   * Fix an out-of-bounds memory access in v3 onion service descriptor
     parsing (CVE-2021-34550, boo#1187325)


   * allow Linux sandbox with Glibc 2.33
   * work with autoconf 2.70+
   * several other minor features and bugfixes (see announcement)

   - Fix logging issue due to systemd picking up stdout - boo#1181244
     Continue to log notices to syslog by default.

Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2021-926=1

Package List:

   - openSUSE Leap 15.2 (x86_64):