openSUSE-SU-2021:0474-1

    Dashboard / Vulnerabilities / openSUSE-SU-2021:0474-1

    openSUSE-SU-2021:0474-1

    Published: 25 Mar 2021Last Modified: 4 Feb 2026

    Summary: Security update for tor

    Details: This update for tor fixes the following issues: tor was updated to 0.4.5.7 * https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html * Fix 2 denial of service security issues (boo#1183726) + Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089) + Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090) * Ship geoip files based on the IPFire Location Database This update was imported from the openSUSE:Leap:15.2:Update update project.

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/D34QNXQE32JN77ED4VWLDVQOC4MRKET6/, https://bugzilla.suse.com/1183726, https://www.suse.com/security/cve/CVE-2021-28089, https://www.suse.com/security/cve/CVE-2021-28090

    Affected packages

    Package

    Name: tor

    Purl: pkg:rpm/suse/tor&distro=SUSE%20Package%20Hub%2015%20SP2

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.4.5.7-bp152.2.9.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2021:0474-1 | CVE-DB