[tor-dev] Tor not affected by recent openssl security advisories

[Nick Mathewson]

Somebody always asks whether Tor is affected by each OpenSSL advisory,
so I'm sending this mail in order to get a URL to send people to.  :)

Here are today's advisories:
   https://mta.openssl.org/pipermail/openssl-announce/2016-January/000061.html

With respect to the first ( "DH small subgroups (CVE-2016-0701)" ),
Tor is not affected because we set the SSL_OP_SINGLE_DH_USE() option.
We started setting this option back in Tor 0.1.1.9-alpha, back in
2005.

With respect to the second ( "SSLv2 doesn't block disabled ciphers
(CVE-2015-3197)" ), Tor is not affected because we disable SSLv2 by
setting SSL_OP_NO_SSLv2. We started setting this option in Tor
0.0.2pre8, back in 2003.


Of course, other applications that you use over Tor may be affected,
even though Tor is not; please remember to upgrade them as patches
become available.

best wishes,
-- 
Nick