CVE-2017-0376

EPSS 0.82%
Veröffentlicht 09.06.2017 17:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle security@debian.org
CVE-Watchlists
Login
Unerledigt
Login

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Torproject ≫ Tor Version < 0.3.0.8

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.82%	0.722

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html

Third Party Advisory

Mailing List

http://www.debian.org/security/2017/dsa-3877

Third Party Advisory

https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd

Patch

Third Party Advisory

Issue Tracking

https://trac.torproject.org/projects/tor/ticket/22494

Third Party Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2017-0376

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-0376

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-0376

EUVD