CVE-2006-3418
published 2006-07-07CVE-2006-3418: Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.10%
79.6th percentile
Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.
Affected
73 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tor | < tor 0.1.1.20-1 (bookworm) | tor 0.1.1.20-1 (bookworm) |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
| tor | tor | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2006-3418: tor - Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint lin...
vendor_debian·2006·CVSS 5.0
CVE-2006-3418 [MEDIUM] CVE-2006-3418: tor - Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint lin...
Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.
Scope: local
bookworm: resolved (fixed in 0.1.1.20-1)
bullseye: resolved (fixed in 0.1.1.20-1)
forky: resolved (fixed in 0.1.1.20-1)
sid: resolved (fixed in 0.1.1.20-1)
trixie: resolved (fixed in 0.1.1.20-1)
GHSA
GHSA-xjm4-pmg6-w3h9: Tor before 0
ghsa_unreviewed·2022-05-01
CVE-2006-3418 [MEDIUM] GHSA-xjm4-pmg6-w3h9: Tor before 0
Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.
OSV
CVE-2006-3418: Tor before 0
osv·2006-07-07·CVSS 5.0
CVE-2006-3418 [MEDIUM] CVE-2006-3418: Tor before 0
Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2006-07-07
Published