Bug 1187322 – VUL-0: CVE-2021-34548: tor: RELAY_END or RELAY_RESOLVED spoofing

Bug 1187322 - (CVE-2021-34548) VUL-0: CVE-2021-34548: tor: RELAY_END or RELAY_RESOLVED spoofing

(CVE-2021-34548)
Summary:	VUL-0: CVE-2021-34548: tor: RELAY_END or RELAY_RESOLVED spoofing

Status:	NEW

Classification:	openSUSE
Product:	openSUSE Distribution
Classification:	openSUSE
Component:	Security
Version:	Leap 15.3
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal (vote)
Target Milestone:	---
Assigned To:	Bernhard Wiedemann
QA Contact:	E-mail List

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2021-06-14 20:11 UTC by Andreas Stieger
Modified:	2021-07-08 19:26 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Andreas Stieger 2021-06-14 20:11:19 UTC

Fixed in tor 0.3.5.15, 0.4.4.9, 0.4.5.9, or 0.4.6.5 

  o Major bugfixes (security, backport from 0.4.6.5):
    - Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on
      half-closed streams. Previously, clients failed to validate which
      hop sent these cells: this would allow a relay on a circuit to end
      a stream that wasn't actually built with it. Fixes bug 40389;
      bugfix on 0.3.5.1-alpha. This issue is also tracked as TROVE-2021-
      003 and CVE-2021-34548.

https://lists.torproject.org/pipermail/tor-announce/2021-June/000220.html
https://lists.torproject.org/pipermail/tor-announce/2021-June/000221.html

Comment 1 OBSbugzilla Bot 2021-06-15 05:30:15 UTC

This is an autogenerated message for OBS integration:
This bug (1187322) was mentioned in
https://build.opensuse.org/request/show/900011 Factory / tor
https://build.opensuse.org/request/show/900012 15.2 / tor
https://build.opensuse.org/request/show/900013 Backports:SLE-15-SP3 / tor
https://build.opensuse.org/request/show/900014 Backports:SLE-15-SP2 / tor

Comment 2 Swamp Workflow Management 2021-06-25 22:16:18 UTC

openSUSE-SU-2021:0926-1: An update that solves three vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1179331,1181244,1187322,1187323,1187324,1187325
CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    tor-0.4.5.9-lp152.2.12.1

Comment 3 Swamp Workflow Management 2021-06-30 13:25:02 UTC

openSUSE-SU-2021:0941-1: An update that solves three vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1179331,1181244,1187322,1187323,1187324,1187325
CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP2 (src):    tor-0.4.5.9-bp152.2.12.1

Comment 4 Swamp Workflow Management 2021-07-08 19:26:15 UTC

openSUSE-SU-2021:0989-1: An update that solves three vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1179331,1181244,1187322,1187323,1187324,1187325
CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP3 (src):    tor-0.4.5.9-bp153.2.3.1