GitHub Advisoryadvisory · crates.io

GHSA-c96h-cxx6-rmg9 Tor path lengths too short when "full Vanguards" configured

MEDIUM Published 2024-05-18 Modified 2025-03-27 Official page ↗
Aliases
CVE-2024-35313
Ecosystem
crates.io
Packages
tor-circmgr, arti
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-130, CWE-754
Reviewed
2024-05-20

Affected packages

• crates.io tor-circmgr: >= 0.18.0, < 0.18.1 → fixed in 0.18.1 • crates.io arti: >= 1.2.2, < 1.2.3 → fixed in 1.2.3

Description

In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.

Related

Alias · CVE (1)

  • CVE-2024-35313 In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004. vulnerability

Weakness · CWE (2)

  • CWE-130 Improper Handling of Length Parameter Inconsistency weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References