tor: information disclosure
| Package(s): | tor | CVE #(s): | |||||
| Created: | September 8, 2015 | Updated: | September 10, 2015 | ||||
| Description: | From the Tor advisory:
When a socks5 client application sends a request with a malformed hostname, the following is logged: Your application (using socks5 to port 42) gave Tor a malformed hostname: [host.example.com]. Rejecting the connection. It should say [scrubbed] as SafeLogging was not set to 0. Bug is in src/or/buffers.c :: parse_socks(), where it uses escaped() on the request address rather than escaped_safe_str_client(). | ||||||
| Alerts: |
| ||||||