NetSight
IP …
high7.5

CVE-2017-8819

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protectio…

Impact

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.

Affected products

VendorProductAffected versions
Tor ProjectTor
before 0.2.5.16
from 0.2.6 before 0.2.8.17
from 0.2.9 before 0.2.9.14
from 0.3.0 before 0.3.0.13
from 0.3.1 before 0.3.1.9
DebianDebian Linux
Versions 8.0, 9.0

References