torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

socks: Make SafeSocks refuse SOCKS4 and accept SOCKS4a

Browse Source 
The logic was inverted. Introduced in commit
9155e08450.

This was reported through our bug bounty program on H1. It fixes the
TROVE-2022-002.

Fixes #40730

Signed-off-by: David Goulet <dgoulet@torproject.org>
This commit is contained in:
David Goulet
2022-12-12 10:02:07 -05:00
parent b117ce48db
commit a282145b36
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/ticket40730
+5
View File
@@ -0,0 +1,5 @@
o Major bugfixes (TROVE-2022-002, client):
- The SafeSocks option had its logic inverted for SOCKS4 and SOCKS4a. It
would let the unsafe SOCKS4 pass but not the safe SOCKS4a one. This is
TROVE-2022-002 which was reported on Hackerone by "cojabo". Fixes bug
40730; bugfix on 0.3.5.1-alpha.