CVEvulnerability
CVE-2017-8822
3.7 LOW
Official page ↗
- Status
- Modified
- Published
- 2017-12-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 3.7 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-417
Description
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.
Affected configurations
• tor project tor (< 0.2.5.16)
• tor project tor (>= 0.2.6 < 0.2.8.17)
• tor project tor (>= 0.2.9 < 0.2.9.14)
• tor project tor (>= 0.3.0 < 0.3.0.13)
• tor project tor (>= 0.3.1 < 0.3.1.9)
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · not in database (1)
References
- https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 Vendor Advisory
- https://bugs.torproject.org/21534 Issue Tracking, Vendor Advisory
- https://bugs.torproject.org/24333 Vendor Advisory
- https://www.debian.org/security/2017/dsa-4054 Third Party Advisory
- https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 Vendor Advisory
- https://bugs.torproject.org/21534 Issue Tracking, Vendor Advisory
- https://bugs.torproject.org/24333 Vendor Advisory
- https://www.debian.org/security/2017/dsa-4054 Third Party Advisory