REDHAT-BUG-2099227: Medium severity tor browser vulnerability
A Denial of Service issue was fixed in tor 0.4.7.8 related to congestion control. RTT estimation can become wedged, seriously degrading congestion control performance on all circuits. This impacts clients, onion services, and relays, and can be triggered remotely by a malicious endpoint.
References: https://gitlab.torproject.org/tpo/core/tor/-/issues/40626 https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html https://github.com/torproject/tor/commit/5a25374209689466e10906a77e66ad717a615a02 https://github.com/torproject/tor/commit/b0496d40197dd5b4fb7b694c1410082d4e34dda6
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2099227?
REDHAT-BUG-2099227 is classified as a Denial of Service vulnerability that can significantly affect the performance of Tor.
How do I fix REDHAT-BUG-2099227?
To fix REDHAT-BUG-2099227, update your Tor software to version 0.4.7.8 or later.
What systems are affected by REDHAT-BUG-2099227?
REDHAT-BUG-2099227 affects clients, onion services, and relays running the Tor Project Tor software.
Can REDHAT-BUG-2099227 be exploited remotely?
Yes, REDHAT-BUG-2099227 can be triggered remotely by a malicious endpoint.
What consequences can arise from REDHAT-BUG-2099227?
The consequences of REDHAT-BUG-2099227 include degraded congestion control performance across all circuits, impacting user experience.