Merge branch 'bug40391_035' into maint-0.3.5

2024-12-06 19:41:15 +01:00 · 2021-06-10 08:41:59 -04:00
parent 7fdfc2ea54 4c06c619fa
commit d71bf986b4
2 changed files with 13 additions and 4 deletions
@@ -0,0 +1,9 @@
+  o Major bugfixes (security):
+    - Resist a hashtable-based CPU denial-of-service attack against
+      relays. Previously we used a naive unkeyed hash function to look up
+      circuits in a circuitmux object. An attacker could exploit this to
+      construct circuits with chosen circuit IDs in order to try to create
+      collisions and make the hash table inefficient.  Now we use a SipHash
+      construction for this hash table instead. Fixes bug 40391; bugfix on
+      0.2.4.4-alpha. This issue is also tracked as TROVE-2021-005.
+      Reported by Jann Horn from Google's Project Zero.