Bug 13334

Summary: [CVE 21] tor 0.4.6.10 CVEs found
Product: [ROSA-based products] ROSA Fresh Reporter: Yury <y.tumanov>
Component: System (kernel, glibc, systemd, bash, PAM...)Assignee: ROSA Linux Bugs <bugs>
Status: VERIFIED FIXED QA Contact: ROSA Linux Bugs <bugs>
Severity: critical    
Priority: High CC: a.proklov, e.malashin, pastordidi, s.matveev, y.tumanov
Version: AllFlags: pastordidi: qa_verified+
y.tumanov: secteam_verified+
a.proklov: published+
Target Milestone: 2021.1 Fresh R12   
Hardware: All   
OS: Linux   
URL: CVE-2023-23589,
Whiteboard:
Platform: 2021.1 ROSA Vulnerability identifier:
RPM Package: ISO-related:
Bad POT generating: Upstream:

Description Yury 2023-05-03 18:21:29 MSK 
Please patch CVEs for package tor version 0.4.6.10
  
INFO (CVEs are): tor 0.4.6.10
 cves found
CVE-2023-23589
Desc: The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-23589
Severity: MEDIUM
Comment 1 Svyatoslav Matveev 2023-05-11 12:10:37 MSK 
********** QA ADVISORY **********

Уязвимость закрыта патчем.

*** tor
https://abf.io/build_lists/4439007
https://abf.io/build_lists/4439008
https://abf.io/build_lists/4439006
https://abf.io/build_lists/4439009
https://abf.io/build_lists/4439010
Comment 2 e.malashin@rosalinux.ru 2023-05-12 18:00:19 MSK 
The update sent to testings
Comment 3 Dmitry Postnikov 2023-05-14 10:05:22 MSK 
********** QA ADVISORY **********
Fix:
CVE-2023-23589
*********************************
QA Verified
Comment 4 Yury 2023-07-25 12:45:34 MSK 
Пожалуйста, только сектим трогает флаг secteam_verified.
Comment 5 Yury 2023-07-25 12:47:19 MSK 
Secteam Verified