[tor-dev] Tor not affected by recent openssl security advisories

Nick Mathewson nickm at torproject.org
Thu Jan 28 15:35:21 UTC 2016

Somebody always asks whether Tor is affected by each OpenSSL advisory,
so I'm sending this mail in order to get a URL to send people to.  :)

Here are today's advisories:

With respect to the first ( "DH small subgroups (CVE-2016-0701)" ),
Tor is not affected because we set the SSL_OP_SINGLE_DH_USE() option.
We started setting this option back in Tor, back in

With respect to the second ( "SSLv2 doesn't block disabled ciphers
(CVE-2015-3197)" ), Tor is not affected because we disable SSLv2 by
setting SSL_OP_NO_SSLv2. We started setting this option in Tor
0.0.2pre8, back in 2003.

Of course, other applications that you use over Tor may be affected,
even though Tor is not; please remember to upgrade them as patches
become available.

best wishes,

More information about the tor-dev mailing list