CVEs have been assigned for DoS issues fixed upstream in tor: http://openwall.com/lists/oss-security/2015/04/06/6 I haven't seen an upstream release announcement, but I guess the reporter on oss-security got it from somewhere. Mageia 4 and Mageia 5 are affected. Reproducible: Steps to Reproduce:
CC: (none) => jani.valimaaWhiteboard: (none) => MGA5TOO, MGA4TOO
0.2.4.27 is there and 0.2.5.12 needs to be submitted.
CC: (none) => oe
Debian has issued an advisory for this on April 6: https://lists.debian.org/debian-security-announce/2015/msg00103.html The DSA will be posted here: https://www.debian.org/security/2015/dsa-3216
URL: (none) => http://lwn.net/Vulnerabilities/639390/
Testing Procedure: https://bugs.mageia.org/show_bug.cgi?id=3953#c4 Advisory: ======================== "disgleirio" discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible (CVE-2015-2928). "DonnchaC" discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidden service descriptors (CVE-2015-2929). Introduction points would accept multiple INTRODUCE1 cells on one circuit, making it inexpensive for an attacker to overload a hidden service with introductions. Introduction points now no longer allow multiple cells of that type on the same circuit. The tor package has been updated to version 0.2.4.27, fixing these issues. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2928 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2929 https://blog.torproject.org/blog/tor-02512-and-0267-are-released https://www.debian.org/security/2015/dsa-3216 ======================== Updated packages in core/updates_testing: ======================== tor-0.2.4.27-1.mga4 from tor-0.2.4.27-1.mga4.src.rpm
Version: Cauldron => 4Assignee: bugsquad => qa-bugsWhiteboard: MGA5TOO, MGA4TOO => has_procedure
Testing on Mageia4x64 real hardware Using privoxy-3.0.21-2.3.mga4 From current package : -------------------- tor-0.2.4.26-1.mga4 Previously installed and tested in previous bug (https://bugs.mageia.org/show_bug.cgi?id=15518#c4) To updated testing package : -------------------------- tor-0.2.4.27-1.mga4.x86_64 $ tor Apr 10 00:00:14.262 [notice] Tor v0.2.4.27 (git-85169a121e3b59d2) running on Linux with Libevent 2.0.21-stable and OpenSSL 1.0.1m. (...) Apr 10 00:01:19.000 [notice] Bootstrapped 100%: Done. Browsed to : https://check.torproject.org/ Congratulations. This browser is configured to use Tor. OK here
CC: (none) => olchalWhiteboard: has_procedure => has_procedure MGA4-64-OK
Testing on Mageia4x32 real hardware Same procedure $ tor Apr 10 00:07:03.714 [notice] Tor v0.2.4.27 (git-85169a121e3b59d2) running (...) Apr 10 00:07:18.000 [notice] Bootstrapped 100%: Done. https://check.torproject.org/ Congratulations. This browser is configured to use Tor. OK for Mageai4x32
Whiteboard: has_procedure MGA4-64-OK => has_procedure MGA4-64-OK MGA4-32-OK
Validating. Advisory uploaded. Please push to 4 updates Thanks
Keywords: (none) => validated_updateWhiteboard: has_procedure MGA4-64-OK MGA4-32-OK => has_procedure advisory MGA4-64-OK MGA4-32-OKCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0151.html
Status: NEW => RESOLVEDResolution: (none) => FIXED