CVE-2020-10593
Fixed in a distro release EPSS 2%
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.
Products: torproject tor, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | tor | 0.4.2.7-1 |
| Debian 13 | tor | 0.4.2.7-1 |
| Debian 14 | tor | 0.4.2.7-1 |
| SUSE Package Hub 12 | tor | 0.4.4.6-bp152.2.3.1 |
| SUSE Package Hub 15 SP1 | tor | 0.4.4.6-bp152.2.3.1 |
| SUSE Package Hub 15 SP1 | tor | 0.3.5.10-bp151.3.3.1 |
| SUSE Package Hub 15 SP2 | tor | 0.4.4.6-bp152.2.3.1 |
| openSUSE Leap 15.1 | tor | 0.3.5.10-lp151.2.3.1 |
| openSUSE Leap 15.1 | tor | 0.4.4.6-bp152.2.3.1 |
| openSUSE Leap 15.2 | tor | 0.4.4.6-bp152.2.3.1 |
| openSUSE Tumbleweed | tor | 0.4.6.7-2.2 |