CVE-2021-22929
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged...
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
- Record
CVE-2021-22929- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-312, CWE-532
- Updated
- 2026-11-02
CVE List No score
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
- Record
CVE-2021-22929- Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2021-10058 No score
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
- Record
EUVD-2021-10058- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x58v-xfqh-24p6 No score
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged...
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
- Record
GHSA-x58v-xfqh-24p6- Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
- Record
CVE-2021-22929- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1513-1 No score
Security update for tor
This update for tor fixes the following issues:
tor 0.4.6.8:
- Improving reporting of general overload state for DNS timeout errors by relays
- Regenerate fallback directories for October 2021
- Bug fixes for onion services
- CVE-2021-22929: do not log v2 onion services access attempt warnings on disk excessively (TROVE-2021-008, boo#1192658)
- Record
openSUSE-SU-2021:1513-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1524-1 No score
Security update for tor
This update for tor fixes the following issues:
tor 0.4.6.8:
- Improving reporting of general overload state for DNS timeout errors by relays
- Regenerate fallback directories for October 2021
- Bug fixes for onion services
- CVE-2021-22929: do not log v2 onion services access attempt warnings on disk excessively (TROVE-2021-008, boo#1192658)
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:1524-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11639-1 No score
tor-0.4.6.8-1.1 on GA media
These are all security issues fixed in the tor-0.4.6.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11639-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torSUSE:Package Hub 15 SP3 |
before 0.4.6.8-bp153.2.9.1 | 0.4.6.8-bp153.2.9.1 |
toropenSUSE:Leap 15.2 |
before 0.4.6.8-bp153.2.9.1 | 0.4.6.8-bp153.2.9.1 |
toropenSUSE:Leap 15.3 |
before 0.4.6.8-bp153.2.9.1 | 0.4.6.8-bp153.2.9.1 |
torSUSE:Package Hub 15 SP2 |
before 0.4.6.8-bp152.2.18.1 | 0.4.6.8-bp152.2.18.1 |
toropenSUSE:Tumbleweed |
before 0.4.6.8-1.1 | 0.4.6.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22929 is a medium vulnerability (CVSS 6.1) in Brave, published August 31, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in tor 0.4.6.8-bp153.2.9.1.
References
hackerone.com/reports/1249056
nvd.nist.gov/vuln/detail/CVE-2021-22929
github.com/advisories/GHSA-x58v-xfqh-24p6
lists.opensuse.org/archives/list/[email protected]/thread/ZELBVBNTOTNRG5IP3NQWA756AE37TH5Y
bugzilla.suse.com/1192658
suse.com/security/cve/CVE-2021-22929