PT-2021-2513 · Tor+4 · Tor+4

Nick Mathewson + 1 · Published 2019-05-07 · Updated 2025-05-12 · CVE-2021-28090

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.5.7

Description The issue is related to the insufficient use of the assert() function in the dirvote add signatures to pending consensus() function of the Tor browser. This allows a remote attacker to cause Tor directory authorities to exit with an assertion failure.

Recommendations For versions prior to 0.4.5.7, update to version 0.4.5.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the dirvote add signatures to pending consensus() function until a patch is available.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALT-PU-2019-1777

ALT-PU-2021-1492

ALT-PU-2025-6362

BDU:2021-01891

CVE-2021-28090

DSA-4871-1

MGASA-2021-0180

OPENSUSE-SU-2021:0461-1

OPENSUSE-SU-2021:0474-1

OPENSUSE-SU-2021_0461-1

OPENSUSE-SU-2024:11469-1

USN-5036-1

Affected Products

Alt Linux

Linuxmint

Suse

Tor

Ubuntu

References · 56

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28090 · Vendor Advisory
• https://gitlab.torproject.org/tpo/core/tor/-/issues/40316 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4871-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5036-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0461-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28090 · Security Note
• https://blog.torproject.org/node/2009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34550 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34549 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-28090 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0180 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0474-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28090 · Vendor Advisory