tor 0.2.5.16-1 source package in Debian

Changelog

tor (0.2.5.16-1) jessie-security; urgency=medium

  * New upstream version, including among others:
    - Fix a denial of service bug where an attacker could use a
      malformed directory object to cause a Tor instance to pause while
      OpenSSL would try to read a passphrase from the terminal. (Tor
      instances run without a terminal, which is the case for most Tor
      packages, are not impacted.) Fixes bug 24246; bugfix on every
      version of Tor. Also tracked as TROVE-2017-011 and CVE-2017-8821.
      Found by OSS-Fuzz as testcase 6360145429790720.
    - When checking for replays in the INTRODUCE1 cell data for a
      (legacy) onion service, correctly detect replays in the RSA-
      encrypted part of the cell. We were previously checking for
      replays on the entire cell, but those can be circumvented due to
      the malleability of Tor's legacy hybrid encryption. This fix helps
      prevent a traffic confirmation attack. Fixes bug 24244; bugfix on
      0.2.4.1-alpha. This issue is also tracked as TROVE-2017-009
      and CVE-2017-8819.
    - When running as a relay, make sure that we never build a path
      through ourselves, even in the case where we have somehow lost the
      version of our descriptor appearing in the consensus. Fixes part
      of bug 21534; bugfix on 0.2.0.1-alpha. This issue is also tracked
      as TROVE-2017-012 and CVE-2017-8822.

 -- Peter Palfrader <email address hidden>  Sat, 02 Dec 2017 16:16:35 +0100

Upload details

Uploaded by:
Peter Palfrader
Uploaded to:
Jessie
Original maintainer:
Peter Palfrader
Architectures:
any all
Section:
net
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Jessie release main net

Builds

Downloads

File Size SHA-256 Checksum
tor_0.2.5.16-1.dsc 1.7 KiB e5abd95783b0b58ce077f686bf88dae386d0bd8c11b0367084cbb808a6c2e3c2
tor_0.2.5.16.orig.tar.gz 3.6 MiB 5a9a28c7ebff6653c346ebaadf95f1fd4b8b47f2c1ceb75f0f60bf64a6ee525f
tor_0.2.5.16-1.diff.gz 34.8 KiB c7c5666bac4157d447876322e692386955f2e989e42359e3596529ad005ed57c

No changes file available.

Binary packages built by this source