NetSight
IP …
low3.7

CVE-2017-8822

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incomple…

Impact

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.

Affected products

VendorProductAffected versions
Tor ProjectTor
before 0.2.5.16
from 0.2.6 before 0.2.8.17
from 0.2.9 before 0.2.9.14
from 0.3.0 before 0.3.0.13
from 0.3.1 before 0.3.1.9
DebianDebian Linux
Versions 8.0, 9.0

Weakness classification

CWE-417

References