oss-security - CVE Request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 08 Dec 2008 11:27:47 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: coley@...re.org
Cc: oss-security <oss-security@...ts.openwall.com>
Subject: CVE Request - tor

Hello Steve,

  the new upstream 0.2.0.32 version of Tor has been released.
It fixes between others also two security issues:

References:
===========
http://blog.torproject.org/blog/tor-0.2.0.32-released
http://bugs.gentoo.org/show_bug.cgi?id=250018
https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17255&view=rev
https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17342&view=rev

Patches (against 0.2.0.32):
===========================
1, User/Group config options from Jacob Appelbaum
and Steven Murdoch (BTS 848 and 857):
https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17255&view=rev

2, The "ClientDNSRejectInternalAddresses" config option:
Backport of R17135 against 0-2-0:  https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17342&view=rev
Original R17135:                   https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17135&view=rev

Affected Tor versions: x <= 0.2.0.32
======================
Checked both vulnerabilities present also in 0.1.2.17 and possibly older versions.

Could you please allocate a new CVE id(s) for these issues?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.