oss-sec mailing list archives
CVE Request - tor
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Mon, 08 Dec 2008 11:27:47 +0100
Hello Steve, the new upstream 0.2.0.32 version of Tor has been released. It fixes between others also two security issues: References: =========== http://blog.torproject.org/blog/tor-0.2.0.32-released http://bugs.gentoo.org/show_bug.cgi?id=250018 https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17255&view=rev https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17342&view=rev Patches (against 0.2.0.32): =========================== 1, User/Group config options from Jacob Appelbaum and Steven Murdoch (BTS 848 and 857): https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17255&view=rev 2, The "ClientDNSRejectInternalAddresses" config option: Backport of R17135 against 0-2-0: https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17342&view=rev Original R17135: https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17135&view=rev Affected Tor versions: x <= 0.2.0.32 ====================== Checked both vulnerabilities present also in 0.1.2.17 and possibly older versions. Could you please allocate a new CVE id(s) for these issues? Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request - tor Jan Lieskovsky (Dec 08)
- Re: CVE Request - tor Steven M. Christey (Dec 16)