{"id":"CVE-2013-7295","aliases":["DEBIAN-CVE-2013-7295","EUVD-2013-7072","GHSA-3x57-m985-pg67","MGASA-2014-0059","openSUSE-SU-2024:10423-1"],"status":"published","title":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting...","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01751,"percentile":0.78019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-01-17T19:00:00Z","modified":"2026-09-01T20:03:19Z","fixes":[{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.2.4.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.2.4.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.2.4.20-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"tor","fixed_in":["0.2.4.20-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"tor","fixed_in":["0.2.4.20-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.20-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.20-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.20-1.mga4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8.11-1.1"}]}],"bundled":22}],"products":[{"vendor":"torproject","product":"tor"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7295"},{"url":"https://github.com/advisories/GHSA-3x57-m985-pg67"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-7295","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0059.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12464","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2929","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-7295","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","status":"published","published":"2014-01-17T19:00:00Z","modified":"2024-08-06T18:01:20.348Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-7072","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","status":"published","published":"2014-01-17T19:00:00Z","modified":"2024-08-06T18:01:20Z","updated_at":"2026-11-03T01:56:23.942036Z"}],"ghsa":[{"id":"GHSA-3x57-m985-pg67","title":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting...","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","status":"published","published":"2022-05-17T04:52:57Z","modified":"2023-01-28T05:02:43Z","updated_at":"2026-11-02T14:43:50.187003Z"}],"nvd":[{"id":"CVE-2013-7295","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","status":"published","published":"2014-01-17T21:55:14.613Z","modified":"2026-06-17T00:01:40.923Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-7295","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","status":"published","published":"2014-01-17T21:55:14Z","modified":"2026-04-16T06:20:33.965506744Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-7295","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.","status":"published","published":"2014-01-17T21:55:14.613Z","modified":"2026-09-01T20:03:19.373302353Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0059","title":"Updated tor package fixes security vulnerability","description":"Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a\ncertain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge\nplatforms, does not properly generate random numbers for relay identity\nkeys and hidden-service identity keys, which might make it easier for\nremote attackers to bypass cryptographic protection mechanisms via\nunspecified vectors (CVE-2013-7295).\n","status":"published","published":"2014-02-12T17:13:24Z","modified":"2026-04-16T06:24:23.169839795Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10423-1","title":"tor-0.2.8.11-1.1 on GA media","description":"These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:58.106216Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}