| Package | Affected versions | Patched versions |
|---|---|---|
| backports sle | = 15.0 | |
| tor | ≥ 0.3.5, < 0.3.5.10> 0.4.1.0, < 0.4.1.9> 0.4.2.0, ≤ 0.4.2.7 | 0.3.5.100.4.1.9 |
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free