[tor-dev] Tor not affected by recent openssl security advisories
nickm at torproject.org
Thu Jan 28 15:35:21 UTC 2016
Somebody always asks whether Tor is affected by each OpenSSL advisory,
so I'm sending this mail in order to get a URL to send people to. :)
Here are today's advisories:
With respect to the first ( "DH small subgroups (CVE-2016-0701)" ),
Tor is not affected because we set the SSL_OP_SINGLE_DH_USE() option.
We started setting this option back in Tor 0.1.1.9-alpha, back in
With respect to the second ( "SSLv2 doesn't block disabled ciphers
(CVE-2015-3197)" ), Tor is not affected because we disable SSLv2 by
setting SSL_OP_NO_SSLv2. We started setting this option in Tor
0.0.2pre8, back in 2003.
Of course, other applications that you use over Tor may be affected,
even though Tor is not; please remember to upgrade them as patches
More information about the tor-dev