Alerts This Week
Warning Icon 1 535
Alerts This Week
Warning Icon 1 535

openSUSE: 2022:10209-1 Moderate: tor DoS Defense Improvements

opensuse
Calendar Grey November 20, 2022
Dist Opensuse Esm H88
Recent openSUSE security patch for tor, aimed at resolving moderate severity vulnerabilities and bolstering defenses against DoS attacks.
An update that contains security fixes can now be installed

Description

This update for tor fixes the following issues:

tor 0.4.7.11:

* Improve security of DNS cache by randomly clipping the TTL value

(boo#1205307, TROVE-2021-009)

* Improved defenses against network-wide DoS, multiple counters and

metrics added to MetricsPorts

* Apply circuit creation anti-DoS defenses if the outbound circuit max

cell queue size is reached too many times. This introduces two new

consensus parameters to control the queue size limit and number of

times allowed to go over that limit.

* Directory authority updates

* IPFire database and geoip updates

* Bump the maximum amount of CPU that can be used from 16 to 128. The

NumCPUs torrc option overrides this hardcoded maximum.

* onion service: set a higher circuit build timeout for opened client

rendezvous circuit to avoid timeouts and retry load

* Make the service retry a rendezvous if the circuit is being repurposed

for...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP4:

zypper in -t patch openSUSE-2022-10209=1

- openSUSE Backports SLE-15-SP3:

zypper in -t patch openSUSE-2022-10209=1

Package List

- openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64):

tor-0.4.7.11-bp154.2.9.1

tor-debuginfo-0.4.7.11-bp154.2.9.1

tor-debugsource-0.4.7.11-bp154.2.9.1

- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):

tor-0.4.7.11-bp153.2.21.1

References

https://bugzilla.suse.com/1205307

Announcement ID: openSUSE-SU-2022:10209-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 .

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here