GitHub Advisoryadvisory · crates.io

GHSA-9328-gcfq-p269 Tor Arti's STUB circuits incorrectly have a length of 2

HIGH Published 2024-05-18 Modified 2024-11-04 Official page ↗
Aliases
CVE-2024-35312
Ecosystem
crates.io
Packages
arti, tor-circmgr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-670, CWE-754
Reviewed
2024-05-20

Affected packages

• crates.io arti: >= 1.2.2, < 1.2.3 → fixed in 1.2.3 • crates.io tor-circmgr: >= 0.18.0, < 0.18.1 → fixed in 0.18.1

Description

In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.

Related

Alias · CVE (1)

  • CVE-2024-35312 In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003. vulnerability

Weakness · CWE (2)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References