| Summary: | tor new security issues CVE-2017-0375 and CVE-2017-0376 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, herman.viaene, jani.valimaa, lewyssmith, sysadmin-bugs |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA5-64-OK MGA5-32-OK advisory | ||
| Source RPM: | tor-0.2.9.10-1.mga6.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2017-06-10 00:19:53 CEST
David Walser
2017-06-10 00:20:00 CEST
Whiteboard:
(none) =>
MGA5TOO Pushed 0.2.8.14 to core/updates_testing for mga5. Freeze push requested to update to 0.2.9.11 in Cauldron. (In reply to Jani Välimaa from comment #2) > Freeze push requested to update to 0.2.9.11 in Cauldron. 0.2.9.11 pushed to Cauldron. Advisory: ======================== Updated tor package fixes security vulnerability: A remotely triggerable assertion failure caused by receiving a BEGIN_DIR cell on a hidden service rendezvous circuit (CVE-2017-0376). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0376 https://blog.torproject.org/blog/tor-0308-released-fix-hidden-services-also-are-02429-02514-02612-0278-02814-and-02911 ======================== Updated packages in core/updates_testing: ======================== tor-0.2.8.14-1.mga5 from tor-0.2.8.14-1.mga5.src.rpm Whiteboard:
MGA5TOO =>
(none) Thanks Jani! Assigning to QA. Advisory and package in Comment 4. CC:
(none) =>
jani.valimaa
Dave Hodgins
2017-06-13 05:19:48 CEST
Whiteboard:
(none) =>
advisory Testing M5 64 bit using the procedure in https://bugs.mageia.org/show_bug.cgi?id=19145#c11 duplicated below. Before update: tor-0.2.8.12-1.mga5 After update: tor-0.2.8.14-1.mga5 Started the tor daemon. Configured Firefox as prescribed: Preferences - Advanced - Connection, Configure: Check the 'Configure manually' radio button: In the bottom line headed SOCKS v5: enter 'localhost' (no quotes); Port 9050 Check the 'SOCKS v5' radio button below Confirm OK the changes. https://check.torproject.org/ -> " Congratulations. This browser is configured to use Tor. Your IP address appears to be: 109.163.234.2 However, it does not appear to be Tor Browser." Update deemed OK. [Undo Firefox changes - simply revert to 'No proxy'] CC:
(none) =>
lewyssmith MGA5-32 on Asus A6000VM Xfce No installation issues Followed above procedure and get same Congratulations from Tor. Reverted back to normal operation. OK Whiteboard:
advisory MGA5-64-OK =>
MGA5-64-OK MGA5-32-OK advisory
Lewis Smith
2017-06-14 17:21:01 CEST
Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0176.html Resolution:
(none) =>
FIXED This update also fixed CVE-2017-0375: https://lists.opensuse.org/opensuse-updates/2017-06/msg00047.html Summary:
tor new security issue CVE-2017-0376 =>
tor new security issues CVE-2017-0375 and CVE-2017-0376 |