openSUSE Security Update: Security update for tor

Announcement ID:    openSUSE-SU-2021:1178-1
Rating:             important
References:         #1189489 
Cross-References:   CVE-2021-38385
Affected Products:
                    openSUSE Backports SLE-15-SP2

   An update that fixes one vulnerability is now available.


   This update for tor fixes the following issues:


   * Fix a DoS via a remotely triggerable assertion failure (boo#1189489,
     TROVE-2021-007, CVE-2021-38385)


   * Fix a compilation error with gcc 7, drop tor-
   * Enable the deterministic RNG for unit tests that covers the address set
     bloomfilter-based API's


   * Add controller support for creating v3 onion services with client auth
   * When voting on a relay with a Sybil-like appearance, add the Sybil flag
     when clearing out the other flags. This lets a relay
     operator know why their relay hasn't been included in the consensus
   * Relays now report how overloaded they are
   * Add a new DoS subsystem to control the rate of client connections for
   * Relays now publish statistics about v3 onions services
   * Improve circuit timeout algorithm for client performance

   This update was imported from the openSUSE:Leap:15.2:Update update project.

Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP2:

      zypper in -t patch openSUSE-2021-1178=1

Package List:

   - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64):