PT-2017-18553 · Tor+1 · Tor+1

Published 2017-12-01 · Updated 2024-06-15 · CVE-2017-8819

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tor versions 0.2.5 through 0.2.5.15 Tor versions 0.2.6 through 0.2.8.16 Tor versions 0.2.9 through 0.2.9.13 Tor versions 0.3.0 through 0.3.0.12 Tor versions 0.3.1 through 0.3.1.8

Description The replay-cache protection mechanism is ineffective for v2 onion services. An attacker can send many INTRODUCE2 cells to trigger this issue.

Recommendations For Tor versions 0.2.5 through 0.2.5.15, update to version 0.2.5.16 or later. For Tor versions 0.2.6 through 0.2.8.16, update to version 0.2.8.17 or later. For Tor versions 0.2.9 through 0.2.9.13, update to version 0.2.9.14 or later. For Tor versions 0.3.0 through 0.3.0.12, update to version 0.3.0.13 or later. For Tor versions 0.3.1 through 0.3.1.8, update to version 0.3.1.9 or later.

Fix

Related Identifiers

ALT-PU-2017-2718

CVE-2017-8819

DSA-4054-1

MGASA-2017-0444

OPENSUSE-SU-2017:3201-1

OPENSUSE-SU-2017:3203-1

OPENSUSE-SU-2024:11469-1

Affected Products

Alt Linux

Tor

References · 40

• https://debian.org/security/2017/dsa-4054 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:3203-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8819 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8819 · Vendor Advisory
• https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 · Vendor Advisory
• https://bugs.torproject.org/24244 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11469-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4054-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0444.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8819 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0444 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-8819 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:3201-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8819 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8819 · Security Note