mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-09-20 13:06:20 +02:00
56a7c5bc15
On an hidden service rendezvous circuit, a BEGIN_DIR could be sent (maliciously) which would trigger a tor_assert() because connection_edge_process_relay_cell() thought that the circuit is an or_circuit_t but is an origin circuit in reality. Fixes #22494 Reported-by: Roger Dingledine <arma@torproject.org> Signed-off-by: David Goulet <dgoulet@torproject.org>
8 lines
287 B
Plaintext
8 lines
287 B
Plaintext
o Major bugfixes (hidden service, relay, security):
|
|
- Fix an assertion failure caused by receiving a BEGIN_DIR cell on
|
|
a hidden service rendezvous circuit. Fixes bug 22494, tracked as
|
|
TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found
|
|
by armadev.
|
|
|
|
|