CVE-2010-0385 — Sensitive Information Exposure in TOR

CWE-200 — Sensitive Information Exposure7 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
0.4%
top 37.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Torproject TORTOR
Timeline
PublishedJan 25
Latest updateMay 2

Description

Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, when functioning as a bridge directory authority, allows remote attackers to obtain sensitive information about bridge identities and bridge descriptors via a dbg-stability.txt directory query.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debiantorproject/tor< 0.2.1.22-1+3
▶NVDtor/tor126 versions+125

🔴Vulnerability Details

3
GHSA
GHSA-j8c7-5jh6-f92f: Tor before 0↗2022-05-02
▶
OSV
CVE-2010-0385: Tor before 0↗2010-01-25
▶
CVEList
CVE-2010-0385: Tor before 0↗2010-01-25
▶

📋Vendor Advisories

1
Debian
CVE-2010-0385: tor - Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, when functioning as a bri...↗2010
▶

💬Community

2
Bugzilla
CVE-2011-0015 CVE-2011-0016 CVE-2011-0427 CVE-2011-0490 CVE-2011-0491 CVE-2011-0492 CVE-2011-0493 CVE-2010-1676 CVE-2010-0383 CVE-2010-0385 tor various flaws [epel-5]↗2011-01-20
▶
Bugzilla
CVE-2010-0383, CVE-2010-0385: tor multiple vulnerabilities in versions prior to 0.2.1.22↗2010-01-22
▶
CVE-2010-0385 — Sensitive Information Exposure in TOR | cvebase