PT-2023-25535 · I2P · I2P

Hbapm6 · Published 2023-08-01 · Updated 2024-11-04 · CVE-2023-36325

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions i2p versions prior to 2.3.0

Description The issue allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy. An attack would take days to complete.

Recommendations Upgrade to i2p version 2.3.0 to mitigate the issue. As a temporary workaround, consider restricting the use of tunneled and replayed messages to minimize the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-36325

Affected Products

I2P

References · 17

• https://ubuntu.com/security/CVE-2023-36325 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-36325 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36325 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36325 · Vendor Advisory
• https://twitter.com/transilienceai/status/1844450316873544078 · Twitter Post
• https://twitter.com/transilienceai/status/1844450324926673368 · Twitter Post
• https://t.me/cvedetector/7435 · Telegram Post
• https://twitter.com/transilienceai/status/1844241354173374538 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1843997539554451497 · Twitter Post
• https://t.me/cvenotify/97558 · Telegram Post
• https://twitter.com/transilienceai/status/1844241363283398830 · Twitter Post
• https://xeiaso.net/blog/CVE-2023-36325 · Note
• https://twitter.com/transilienceai/status/1844605627026256347 · Twitter Post
• https://geti2p.net/en/blog/post/2023/06/25/new_release_2.3.0 · Note
• https://twitter.com/transilienceai/status/1844605619644301328 · Twitter Post