CVE-2021-34548
published 2021-06-29CVE-2021-34548: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.72%
84.4th percentile
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tor | < tor 0.4.5.9-1 (bookworm) | tor 0.4.5.9-1 (bookworm) |
| torproject | tor | < 0.3.5.15 | 0.3.5.15 |
| torproject | tor | >= 0 < 0.4.5.9-1 | 0.4.5.9-1 |
| torproject | tor | >= 0 < 0.4.5.9-1 | 0.4.5.9-1 |
| torproject | tor | >= 0 < 0.4.5.9-1 | 0.4.5.9-1 |
| torproject | tor | >= 0 < 0.4.5.9-1 | 0.4.5.9-1 |
| torproject | tor | >= 0 < 0.2.4.27-1ubuntu0.1+esm2 | 0.2.4.27-1ubuntu0.1+esm2 |
| torproject | tor | >= 0 < 0.2.9.14-1ubuntu1~16.04.3+esm1 | 0.2.9.14-1ubuntu1~16.04.3+esm1 |
| torproject | tor | >= 0 < 0.3.2.10-1ubuntu0.2~esm2 | 0.3.2.10-1ubuntu0.2~esm2 |
| torproject | tor | >= 0 < 0.4.2.7-1ubuntu0.1~esm1 | 0.4.2.7-1ubuntu0.1~esm1 |
| torproject | tor | >= 0.4.0.0 < 0.4.4.9 | 0.4.4.9 |
| torproject | tor | >= 0.4.5.0 < 0.4.5.9 | 0.4.5.9 |
| torproject | tor | >= 0.4.6.0 < 0.4.6.5 | 0.4.6.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tor vulnerabilities
osv·2022-10-04·CVSS 7.5
CVE-2019-8955 [HIGH] tor vulnerabilities
tor vulnerabilities
It was discovered that Tor incorrectly handled certain memory operations. A
remote attacker could use this issue to cause a denial of service. This issue
only affected Ubuntu 18.04 ESM. (CVE-2019-8955)
It was discovered that Tor did not properly handle the input length to
dump_desc() function. A remote attacker could use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-28089)
It was discovered that Tor did not properly sanitize the relay nickname in
dirvote_add_signatures_to_pending_consensus() function. An attacker could
possibly use this issue to cause an assertion failure and then cause a denial
of service. (CVE-2021-28090)
It was discovered that Tor did not properly validate the
GHSA
GHSA-5hfr-xvmr-9cjw: An issue was discovered in Tor before 0
ghsa_unreviewed·2022-05-24
CVE-2021-34548 [HIGH] CWE-863 GHSA-5hfr-xvmr-9cjw: An issue was discovered in Tor before 0
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
OSV
CVE-2021-34548: An issue was discovered in Tor before 0
osv·2021-06-29·CVSS 7.5
CVE-2021-34548 [HIGH] CVE-2021-34548: An issue was discovered in Tor before 0
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
Ubuntu
Tor vulnerabilities
vendor_ubuntu·2022-10-04·CVSS 7.5
CVE-2021-34550 [HIGH] Tor vulnerabilities
Title: Tor vulnerabilities
Summary: Several security issues were fixed in Tor.
It was discovered that Tor incorrectly handled certain memory operations. A
remote attacker could use this issue to cause a denial of service. This issue
only affected Ubuntu 18.04 ESM. (CVE-2019-8955)
It was discovered that Tor did not properly handle the input length to
dump_desc() function. A remote attacker could use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-28089)
It was discovered that Tor did not properly sanitize the relay nickname in
dirvote_add_signatures_to_pending_consensus() function. An attacker could
possibly use this issue to cause an assertion failure and then cause a denial
of service. (CVE-2021-28090
Debian
CVE-2021-34548: tor - An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker c...
vendor_debian·2021·CVSS 7.5
CVE-2021-34548 [HIGH] CVE-2021-34548: tor - An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker c...
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
Scope: local
bookworm: resolved (fixed in 0.4.5.9-1)
bullseye: resolved (fixed in 0.4.5.9-1)
forky: resolved (fixed in 0.4.5.9-1)
sid: resolved (fixed in 0.4.5.9-1)
trixie: resolved (fixed in 0.4.5.9-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.htmlhttps://blog.torproject.org/node/2041https://gitlab.torproject.org/tpo/core/tor/-/issues/40389https://security.gentoo.org/glsa/202107-25http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.htmlhttps://blog.torproject.org/node/2041https://gitlab.torproject.org/tpo/core/tor/-/issues/40389https://security.gentoo.org/glsa/202107-25
2021-06-29
Published