Updated tor package fixes security vulnerabilities
Publication date: 12 Oct 2026Modification date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
Description
This update fixes security issues:
- Only accept a CONFLUX_LINK cell on a plain OR circuit, and refuse to
turn a (pending) conflux leg into an introduction or rendezvous point.
Previously a client could link a rendezvous-point circuit into a conflux
set and then, with a forged sequence number in the LINK cell, make the
relay tear the set down from inside the rendezvous splice, triggering a
fatal assertion in assert_circuit_ok(). Also reject a LINK/LINKED cell
whose last_seqno_recv is above what we ever sent on the set.
- Correctly copy the MiddleOnly flag from routerstatuses to node
objects.
Without this fix, the MiddleOnly flag was ignored on non-authorities,
and
clients could use MiddleOnly relays for inappropriate roles in onion
service circuits. Tracked as TROVE-2026-067.
- Treat a router descriptor as expired if any of its family certificates
has expired. Previously, we incorrectly ignored the expiration time of
the family certificate. Tracked as TROVE-2026-062.
References
SRPMS
10/core
- tor-0.4.9.14-1.mga10