PT-2023-19061 · Tor+1 · Tor+1

Published 2023-01-13 · Updated 2025-05-12 · CVE-2023-23589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.7.13

Description The issue is related to a logic error in the SafeSocks option, where the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol.

Recommendations For versions prior to 0.4.7.13, update to version 0.4.7.13 or later to resolve the issue.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

ALT-PU-2023-1040

ALT-PU-2023-1190

ALT-PU-2025-6362

CVE-2023-23589

DLA-3286-1

DSA-5320-1

MGASA-2023-0017

ROSA-SA-2023-2219

Affected Products

Alt Linux

Tor

References · 46

• 🔥 https://gitlab.torproject.org/tpo/core/tor/-/issues/40730 · Exploit
• https://security.gentoo.org/glsa/202305-11 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3286-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34548 · Security Note
• https://debian.org/security/2023/dsa-5320 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3838 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-23589 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34550 · Security Note
• https://bdu.fstec.ru/vul/2021-01909 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1040 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23589 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04716 · Security Note
• https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38385 · Security Note