Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Debian DEBIAN-CVE-2021-28089 tor Fixed in: 0.4.5.7-1

References

• advisory blog.torproject.org
• advisory gitlab.torproject.org
• advisory security.gentoo.org
• web lists.fedoraproject.org