Roger Dingledine

**Name of the Vulnerable Software and Affected Versions** Tor versions prior to 0.3.0.8 **Description** The issue allows for a denial of service, causing an assertion failure and daemon exit in the `connection edge process relay cell` function. This occurs when a BEGIN DIR cell is sent on a rendezvous circuit. **Recommendations** For versions prior to 0.3.0.8, update to version 0.3.0.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the `connection edge process relay cell` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tor versions prior to 0.2.1.22 Tor versions 0.2.2.x prior to 0.2.2.7-alpha **Description** The issue makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations due to the use of deprecated identity keys for certain directory authorities. **Recommendations** For Tor versions prior to 0.2.1.22, update to version 0.2.1.22 or later. For Tor versions 0.2.2.x prior to 0.2.2.7-alpha, update to version 0.2.2.7-alpha or later.

**Name of the Vulnerable Software and Affected Versions** Tor versions 0.1.0.x through 0.1.0.17 Tor versions 0.1.1.x through 0.1.1.22 ScatterChat versions prior to 1.0.2 **Description** The issue allows remote attackers operating a Tor entry node to route arbitrary Tor traffic through clients or cause a denial of service via unspecified vectors. **Recommendations** For Tor versions 0.1.0.x through 0.1.0.17, update to version 0.1.0.18 or later. For Tor versions 0.1.1.x through 0.1.1.22, update to version 0.1.1.23 or later. For ScatterChat versions prior to 1.0.2, update to version 1.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Tor versions 0.1.0.13 and earlier Tor experimental versions 0.1.1.4-alpha and earlier **Description** The issue allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit when using ephemeral Diffie-Hellman (DH) handshakes, due to the failure to reject certain weak keys. **Recommendations** For Tor versions 0.1.0.13 and earlier, update to a version that rejects weak keys in ephemeral Diffie-Hellman handshakes. For Tor experimental versions 0.1.1.4-alpha and earlier, update to a version that rejects weak keys in ephemeral Diffie-Hellman handshakes.