CVE-2021-28090
published 2021-03-19CVE-2021-28090: Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
2.10%
79.6th percentile
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tor | < tor 0.4.5.7-1 (bookworm) | tor 0.4.5.7-1 (bookworm) |
| fedoraproject | fedora | — | — |
| torproject | tor | < 0.3.5.14 | 0.3.5.14 |
| torproject | tor | — | — |
| torproject | tor | — | — |
| torproject | tor | — | — |
| torproject | tor | — | — |
| torproject | tor | >= 0 < 0.4.5.7-1 | 0.4.5.7-1 |
| torproject | tor | >= 0 < 0.4.5.7-1 | 0.4.5.7-1 |
| torproject | tor | >= 0 < 0.4.5.7-1 | 0.4.5.7-1 |
| torproject | tor | >= 0 < 0.4.5.7-1 | 0.4.5.7-1 |
| torproject | tor | >= 0 < 0.2.4.27-1ubuntu0.1+esm2 | 0.2.4.27-1ubuntu0.1+esm2 |
| torproject | tor | >= 0 < 0.2.9.14-1ubuntu1~16.04.3+esm1 | 0.2.9.14-1ubuntu1~16.04.3+esm1 |
| torproject | tor | >= 0 < 0.3.2.10-1ubuntu0.2~esm2 | 0.3.2.10-1ubuntu0.2~esm2 |
| torproject | tor | >= 0 < 0.4.2.7-1ubuntu0.1~esm1 | 0.4.2.7-1ubuntu0.1~esm1 |
| torproject | tor | >= 0.4.4.4 < 0.4.4.8 | 0.4.4.8 |
| torproject | tor | >= 0.4.5.0 < 0.4.5.7 | 0.4.5.7 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tor vulnerabilities
osv·2022-10-04·CVSS 7.5
CVE-2019-8955 [HIGH] tor vulnerabilities
tor vulnerabilities
It was discovered that Tor incorrectly handled certain memory operations. A
remote attacker could use this issue to cause a denial of service. This issue
only affected Ubuntu 18.04 ESM. (CVE-2019-8955)
It was discovered that Tor did not properly handle the input length to
dump_desc() function. A remote attacker could use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-28089)
It was discovered that Tor did not properly sanitize the relay nickname in
dirvote_add_signatures_to_pending_consensus() function. An attacker could
possibly use this issue to cause an assertion failure and then cause a denial
of service. (CVE-2021-28090)
It was discovered that Tor did not properly validate the
GHSA
GHSA-79hx-qq8c-36qm: Tor before 0
ghsa_unreviewed·2022-05-24
CVE-2021-28090 [MEDIUM] GHSA-79hx-qq8c-36qm: Tor before 0
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
OSV
CVE-2021-28090: Tor before 0
osv·2021-03-19·CVSS 5.3
CVE-2021-28090 [MEDIUM] CVE-2021-28090: Tor before 0
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
Ubuntu
Tor vulnerabilities
vendor_ubuntu·2022-10-04·CVSS 7.5
CVE-2021-34550 [HIGH] Tor vulnerabilities
Title: Tor vulnerabilities
Summary: Several security issues were fixed in Tor.
It was discovered that Tor incorrectly handled certain memory operations. A
remote attacker could use this issue to cause a denial of service. This issue
only affected Ubuntu 18.04 ESM. (CVE-2019-8955)
It was discovered that Tor did not properly handle the input length to
dump_desc() function. A remote attacker could use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-28089)
It was discovered that Tor did not properly sanitize the relay nickname in
dirvote_add_signatures_to_pending_consensus() function. An attacker could
possibly use this issue to cause an assertion failure and then cause a denial
of service. (CVE-2021-28090
Debian
CVE-2021-28090: tor - Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities t...
vendor_debian·2021·CVSS 5.3
CVE-2021-28090 [MEDIUM] CVE-2021-28090: tor - Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities t...
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
Scope: local
bookworm: resolved (fixed in 0.4.5.7-1)
bullseye: resolved (fixed in 0.4.5.7-1)
forky: resolved (fixed in 0.4.5.7-1)
sid: resolved (fixed in 0.4.5.7-1)
trixie: resolved (fixed in 0.4.5.7-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://blog.torproject.org/node/2009https://bugs.torproject.org/tpo/core/tor/40316https://gitlab.torproject.org/tpo/core/tor/-/issues/40316https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/https://security.gentoo.org/glsa/202107-25https://blog.torproject.org/node/2009https://bugs.torproject.org/tpo/core/tor/40316https://gitlab.torproject.org/tpo/core/tor/-/issues/40316https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/https://security.gentoo.org/glsa/202107-25
2021-03-19
Published