MGASA-2023-0017

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2023-0017.html

Import Source

https://advisories.mageia.org/MGASA-2023-0017.json

JSON Data

https://api.osv.dev/v1/vulns/MGASA-2023-0017

Related

CVE-2023-23589

Published

2023-01-24T07:58:25Z

Modified

2023-01-24T06:34:36Z

Summary

Updated tor packages fix security vulnerability

Details

SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002. (CVE-2023-23589)

References

https://advisories.mageia.org/MGASA-2023-0017.html
https://bugs.mageia.org/show_bug.cgi?id=31414
https://forum.torproject.net/t/stable-release-0-4-5-16-and-0-4-7-13/6216
https://www.debian.org/security/2023/dsa-5320

Credits

- Mageia - COORDINATOR
- - https://wiki.mageia.org/en/Packages_Security_Team

Affected packages

Mageia:8 / tor

Package

Name: tor
Purl: pkg:rpm/mageia/tor?arch=source&distro=mageia-8

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.5.16-1.mga8

Ecosystem specific

{
    "section": "core"
}