tor/trove-2017-012-part1 at d60dc27555a2bed448617e0b82e61817c9cff895 - tor - Git with a cup of Datura seeds

nihilist/tor

mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 12:23:32 +01:00

David Goulet 6ab07419c8 Use local descriptor object to exclude self in path selection

TROVE-2017-12. Severity: Medium

When choosing a random node for a circuit, directly use our router
descriptor to exclude ourself instead of the one in the global
descriptor list. That list could be empty because tor could be
downloading them which could lead to not excluding ourself.

Closes #21534

2017-11-28 19:14:10 -05:00

7 lines

365 B

Plaintext

Raw Blame History

   o Major bugfixes (security, relay):
     - When running as a relay, make sure that we never build a path through
       ourselves, even in the case where we have somehow lost the version of
       our descriptor appearing in the consensus. Fixes part of bug 21534;
       bugfix on 0.2.0.1-alpha. This issue is also tracked as TROVE-2017-012
       and CVE-2017-8822.