PT-2022-6632 · Tor+1 · Tor+1

Published 2022-06-17 · Updated 2024-06-15 · CVE-2022-33903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tor versions 0.4.7.x through 0.4.7.7

Description The issue is related to incorrect cleanup or release of resources, which can be exploited by a remote attacker to cause a denial of service via the wedging of RTT estimation. This can potentially impact the anonymity provided by the Tor network.

Recommendations For Tor versions 0.4.7.x through 0.4.7.7, update to version 0.4.7.8 to resolve the issue.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALT-PU-2022-2070

ALT-PU-2022-2091

BDU:2023-02936

CVE-2022-33903

OPENSUSE-SU-2022:10023-1

OPENSUSE-SU-2024:12149-1

Affected Products

Alt Linux

Tor

References · 15

• https://security-tracker.debian.org/tracker/CVE-2022-33903 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-33903 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33903 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10023-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12149-1 · Vendor Advisory
• https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02936 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33903 · Vendor Advisory
• https://t.me/cibsecurity/46406 · Telegram Post
• https://t.me/opennews/10240 · Telegram Post
• https://suse.com/security/cve/CVE-2022-33903 · Note
• https://t.me/cvenotify/33255 · Telegram Post
• https://bugzilla.suse.com/1200672 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NKHAXM5C4XR2I62FUPOANDEWE7DEFBS6 · Note