CVE-2010-0383 — Sensitive Information Exposure in TOR

CWE-200 — Sensitive Information Exposure8 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 35.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Torproject TORTOR
Timeline
PublishedJan 25
Latest updateMay 2

Description

Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity keys for certain directory authorities, which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debiantorproject/tor< 0.2.1.22-1+3
▶NVDtor/tor126 versions+125

🔴Vulnerability Details

3
GHSA
GHSA-rgxv-h9h8-fc97: Tor before 0↗2022-05-02
▶
OSV
CVE-2010-0383: Tor before 0↗2010-01-25
▶
CVEList
CVE-2010-0383: Tor before 0↗2010-01-25
▶

📋Vendor Advisories

1
Debian
CVE-2010-0383: tor - Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity ...↗2010
▶

💬Community

3
Bugzilla
CVE-2011-0015 CVE-2011-0016 CVE-2011-0427 CVE-2011-0490 CVE-2011-0491 CVE-2011-0492 CVE-2011-0493 CVE-2010-1676 CVE-2010-0383 CVE-2010-0385 tor various flaws [epel-5]↗2011-01-20
▶
Bugzilla
CVE-2010-0090 JDK unspecified vulnerability in JavaWS/Plugin component↗2010-03-31
▶
Bugzilla
CVE-2010-0383, CVE-2010-0385: tor multiple vulnerabilities in versions prior to 0.2.1.22↗2010-01-22
▶
CVE-2010-0383 — Sensitive Information Exposure in TOR | cvebase