CVE-2005-2643 — TOR vulnerability

5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
0.4%
top 38.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Torproject TORTOR
Timeline
PublishedAug 23
Latest updateMay 1

Description

Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debiantorproject/tor< 0.1.0.14-1+3
▶NVDtor/tor27 versions+26

Patches

Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-jxhg-8chc-rj8x: Tor 0↗2022-05-01
▶
OSV
CVE-2005-2643: Tor 0↗2005-08-23
▶
CVEList
CVE-2005-2643: Tor 0↗2005-08-21
▶

📋Vendor Advisories

1
Debian
CVE-2005-2643: tor - Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, d...↗2005
▶
CVE-2005-2643 — TOR vulnerability | cvebase