Bug 219941

Summary:	Tor < 0.1.1.26 has security problem
Product:	[Fedora] Fedora	Reporter:	Roozbeh Pournader <roozbeh>
Component:	tor	Assignee:	Enrico Scholz <rh-bugzilla>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	6	CC:	extras-qa, fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://archives.seul.org/or/announce/Dec-2006/msg00000.html
Whiteboard:
Fixed In Version:	0.1.1.26-1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-12-18 08:10:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Roozbeh Pournader 2006-12-17 11:54:37 UTC

Description of problem:

Tor 0.1.1.26 fixes a serious privacy bug for people who use the
HttpProxyAuthenticator config option: Tor would send your proxy auth
directly to the directory server when you're tunnelling directory
requests through Tor. Specifically, this happens when publishing or
accessing hidden services, or when you have set FascistFirewall or
ReachableAddresses and you're accessing a directory server that's not
reachable directly.

Version-Release number of selected component (if applicable):
tor-0.1.1.25-1.fc6

Comment 1 Enrico Scholz 2006-12-18 08:10:57 UTC

thx; updated to 0.1.1.26