PT-2023-25535 · I2P · I2P

Hbapm6 · Publicado 2023-08-01 · Atualizado 2024-11-04 · CVE-2023-36325

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions i2p versions prior to 2.3.0

Description The issue allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy. An attack would take days to complete.

Recommendations Upgrade to i2p version 2.3.0 to mitigate the issue. As a temporary workaround, consider restricting the use of tunneled and replayed messages to minimize the risk of exploitation.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2023-36325

Produtos afetados

I2P

Referências · 17

• https://twitter.com/transilienceai/status/1844450316873544078 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1844450324926673368 · Publicação no Twitter
• https://t.me/cvedetector/7435 · Publicação no Telegram
• https://twitter.com/transilienceai/status/1844241354173374538 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1843997539554451497 · Publicação no Twitter
• https://t.me/cvenotify/97558 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-36325 · Aviso do Fabricante
• https://twitter.com/transilienceai/status/1844241363283398830 · Publicação no Twitter
• https://xeiaso.net/blog/CVE-2023-36325 · Nota
• https://twitter.com/transilienceai/status/1844605627026256347 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2023-36325 · Nota de Segurança
• https://geti2p.net/en/blog/post/2023/06/25/new_release_2.3.0 · Nota
• https://twitter.com/transilienceai/status/1844605619644301328 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-36325 · Nota de Segurança
• https://twitter.com/CVEnew/status/1843889513564954847 · Publicação no Twitter