7.5

CVE-2019-8955

In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Torproject ≫ Tor Version < 0.3.3.12
Torproject ≫ Tor Version >= 0.3.4.8 < 0.3.4.11
Torproject ≫ Tor Version 0.3.4.0 Update alpha-dev
Torproject ≫ Tor Version 0.3.4.1 Update alpha
Torproject ≫ Tor Version 0.3.4.2 Update alpha
Torproject ≫ Tor Version 0.3.4.3 Update alpha
Torproject ≫ Tor Version 0.3.4.4 Update rc
Torproject ≫ Tor Version 0.3.4.5 Update rc
Torproject ≫ Tor Version 0.3.4.6 Update rc
Torproject ≫ Tor Version 0.3.4.7 Update rc
Torproject ≫ Tor Version 0.3.5.0 Update alpha-dev
Torproject ≫ Tor Version 0.3.5.1 Update alpha
Torproject ≫ Tor Version 0.3.5.2 Update alpha
Torproject ≫ Tor Version 0.3.5.3 Update alpha
Torproject ≫ Tor Version 0.3.5.4 Update alpha
Torproject ≫ Tor Version 0.3.5.5 Update alpha
Torproject ≫ Tor Version 0.3.5.6 Update rc
Torproject ≫ Tor Version 0.3.5.7
Torproject ≫ Tor Version 0.4.0.1 Update alpha
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.57% 0.904
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html
http://www.securityfocus.com/bid/107136
Third Party Advisory
VDB Entry
https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312
Vendor Advisory
https://trac.torproject.org/projects/tor/ticket/29168
Vendor Advisory