PT-2017-18556 · Tor+1 · Tor+1

Published 2017-12-01 · Updated 2024-06-15 · CVE-2017-8822

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tor versions 0.2.6 through 0.2.8 before 0.2.8.17 Tor versions 0.2.9 before 0.2.9.14 Tor versions 0.3.0 before 0.3.0.13 Tor versions 0.3.1 before 0.3.1.9 Tor version 0.2.5.16 and earlier

Description The issue allows relays with incompletely downloaded descriptors to pick themselves in a circuit path. This leads to a degradation of anonymity.

Recommendations For Tor versions 0.2.6 through 0.2.8 before 0.2.8.17, update to version 0.2.8.17 or later. For Tor versions 0.2.9 before 0.2.9.14, update to version 0.2.9.14 or later. For Tor versions 0.3.0 before 0.3.0.13, update to version 0.3.0.13 or later. For Tor versions 0.3.1 before 0.3.1.9, update to version 0.3.1.9 or later. For Tor version 0.2.5.16 and earlier, update to version 0.2.5.16 or later.

Fix

Weakness Enumeration

CWE-417

Related Identifiers

ALT-PU-2017-2718

CVE-2017-8822

DSA-4054-1

MGASA-2017-0444

OPENSUSE-SU-2017:3201-1

OPENSUSE-SU-2017:3203-1

OPENSUSE-SU-2024:11469-1

Affected Products

Alt Linux

Tor

References · 41

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8822 · Vendor Advisory
• https://debian.org/security/2017/dsa-4054 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8822 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:3203-1 · Vendor Advisory
• https://bugs.torproject.org/21534 · Vendor Advisory
• https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8822 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8822 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11469-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4054-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0444.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8822 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0444 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8822 · Vendor Advisory
• https://bugs.torproject.org/24333 · Vendor Advisory