Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Re: Fwd: Tor Project Forum: Security Release 0.4.9.12

oss-security ()1
Read at seclists.org
Part of a story covered by 2 sourcesTor ships back-to-back security releases 0.4.9.12 and 0.4.9.13, fixing high-severity flaws including undetectable guard-led circuit tamperingMerged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

Tor 0.4.9.12 patches a flaw that lets a malicious guard redirect circuit building to chosen relays undetected.

Sam James highlighted Tor Project security release 0.4.9.12 on the oss-security list. He called out a circuit-building flaw as the most significant issue: a malicious guard can influence which relays a circuit uses, and Tor does not detect the tampering. The post cites no CVE and does not report active exploitation.

Key facts
  • oss-security discussion of Tor security release 0.4.9.12.
  • A malicious guard can steer circuits toward relays it chooses.
  • Tor does not detect that circuit-building tampering.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
tortor-projectanonymitycircuit-buildingsecurity-release
Vendors
Tor Project
Products
Tor
Organizations
Tor Project

From the original article

Posted by Sam James on Sep 23 Sam James writes: https://gitlab. torproject. org/tpo/core/tor/-/work_items/XXXX.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.