Every CVE Search/ Get API key

CVE-2017-8823

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before...

8.1 HighFix available

CVE-2017-8823 is a high vulnerability (CVSS 8.1) in Tor Project Tor, published December 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in tor 0.3.1.9-1.

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.60%Up 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
CVE-2017-8823
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
CVE-2017-8823
Updated
2026-11-02
EUVDEUVD-2017-17766 No score

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
EUVD-2017-17766
Updated
2026-11-03
GitHub AdvisoriesGHSA-j544-8gx2-gmf8 8.1

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before...

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
GHSA-j544-8gx2-gmf8
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 8.1

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
CVE-2017-8823
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-8823 8.1

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
DEBIAN-CVE-2017-8823
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-8823 8.1

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Record
UBUNTU-CVE-2017-8823
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0444 No score

Updated tor packages fix security vulnerability

When checking for replays in the INTRODUCE1 cell data for a (legacy) onion service, Tor didn't correctly detect replays in the RSA- encrypted part of the cell. It was previously checking for replays on the entire cell, but those can be circumvented due to the malleability of Tor's legacy hybrid encryption. This can lead to a traffic confirmation attack (CVE-2017-8819).

Denial of service issue where an attacker could crash a directory authority using a malformed router descriptor (CVE-2017-8820).

Denial of service bug where an attacker could use a malformed directory object to cause a Tor instance to pause while OpenSSL would try to read a passphrase from the terminal (CVE-2017-8821).

When running as a relay, Tor could build a path through itself, especially when it lost the version of its descriptor appearing in the consensus. When running as a relay, it could also choose itself as a guard (CVE-2017-8822).

Use-after-free error that could crash v2 Tor onion services when they failed to open circuits while expiring introduction points (CVE-2017-8823).

Record
MGASA-2017-0444
Updated
2026-11-02
OSVopenSUSE-SU-2017:3201-1 No score

Security update for tor

This update for tor fixes vulnerabilities that allowed some traffic confirmation, DoS and other attacks (bsc#1070849):

  • CVE-2017-8819: Replay-cache ineffective for v2 onion services
  • CVE-2017-8820: Remote DoS attack against directory authorities
  • CVE-2017-8821: An attacker can make Tor ask for a password
  • CVE-2017-8822: Relays can pick themselves in a circuit path
  • CVE-2017-8823: Use-after-free in onion service v2
Record
openSUSE-SU-2017:3201-1
Updated
2026-11-02
OSVopenSUSE-SU-2017:3203-1 No score

Security update for tor

This update for tor fixes vulnerabilities that allowed some traffic confirmation, DoS and other attacks (bsc#1070849):

  • CVE-2017-8819: Replay-cache ineffective for v2 onion services
  • CVE-2017-8820: Remote DoS attack against directory authorities
  • CVE-2017-8821: An attacker can make Tor ask for a password
  • CVE-2017-8822: Relays can pick themselves in a circuit path
  • CVE-2017-8823: Use-after-free in onion service v2
Record
openSUSE-SU-2017:3203-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11469-1 No score

tor-0.4.6.7-2.2 on GA media

These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11469-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tor
Debian:12
 before 0.3.1.9-1
0.3.1.9-1
tor
Debian:13
 before 0.3.1.9-1
0.3.1.9-1
tor
Debian:14
 before 0.3.1.9-1
0.3.1.9-1
tor
Debian:8
 before 0.2.5.16-1, plus listed versions
0.2.5.12-10.2.5.12-20.2.5.12-30.2.5.12-40.2.5.14-10.2.5.15-1
0.2.5.16-1
tor
Debian:9
 before 0.2.9.14-1, plus listed versions
0.2.9.10-10.2.9.11-10.2.9.11-1~bpo8+10.2.9.11-1~deb9u10.2.9.12-10.2.9.12-1~bpo8+10.2.9.13-10.2.9.14-1~bpo8+1
0.2.9.14-1
tor
Mageia:5
 before 0.2.8.17-1.mga5
0.2.8.17-1.mga5
tor
Mageia:6
 before 0.2.9.14-1.mga6
0.2.9.14-1.mga6
tor
Ubuntu:16.04:LTS
 before 0.2.9.14-1ubuntu1~16.04.2, plus listed versions
0.2.6.10-1ubuntu20.2.7.6-1ubuntu10.2.9.11-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.1
0.2.9.14-1ubuntu1~16.04.2
tor
SUSE:Package Hub 12
 before 0.3.1.9-8.1
0.3.1.9-8.1
tor
openSUSE:Tumbleweed
 before 0.4.6.7-2.2
0.4.6.7-2.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open