{"id":"MGASA-2026-0489","summary":"Updated tor package fixes security vulnerabilities","details":"This update fixes security issues:\n- Only accept a CONFLUX_LINK cell on a plain OR circuit, and refuse to\nturn a (pending) conflux leg into an introduction or rendezvous point.\nPreviously a client could link a rendezvous-point circuit into a conflux\nset and then, with a forged sequence number in the LINK cell, make the\nrelay tear the set down from inside the rendezvous splice, triggering a\nfatal assertion in assert_circuit_ok(). Also reject a LINK/LINKED cell\nwhose last_seqno_recv is above what we ever sent on the set.\n- Correctly copy the MiddleOnly flag from routerstatuses to node\nobjects.\nWithout this fix, the MiddleOnly flag was ignored on non-authorities,\nand\nclients could use MiddleOnly relays for inappropriate roles in onion\nservice circuits. Tracked as TROVE-2026-067.\n- Treat a router descriptor as expired if any of its family certificates\nhas expired. Previously, we incorrectly ignored the expiration time of\nthe family certificate. Tracked as TROVE-2026-062.\n","modified":"2026-10-12T19:00:44.448138879Z","published":"2026-10-12T18:47:12Z","references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0489.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36473"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/10/07/33"}],"affected":[{"package":{"name":"tor","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/tor?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.14-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0489.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}