New OpenSSL vulnerability; Tor not affected

There's a new buffer overflow vulnerability in versions of OpenSSL from 0.9.8f through 0.9.8o, and 1.0.0 through 1.0.0a. You can read the security advisory for the whole story.

So far as we can tell from our current analysis, Tor is not affected. Here's why:

The advisory says:

Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected.

Tor qualifies for both of the safe cases: Tor does disable OpenSSL's internal session caching. This happens in the file src/common/tortls.c, when we call SSL_CTX_set_session_cache_mode(result->ctx,SSL_SESS_CACHE_OFF). Tor has done this since since version 0.0.2pre6 back in 2003.

Also, though Tor is multithreaded, Tor only calls SSL functionality from a single thread. Thus, no thread other than the main thread will examine or alter the TLS session cache, or any TLS session at all.

So it would appear that Tor itself is in the clear. Nonetheless, your other applications might not be. If you're running other SSL services that might be affected, be sure to apply patches from your OS and/or your application to stay safe.