{"id":"CVE-2017-8819","aliases":["DEBIAN-CVE-2017-8819","DSA-4054-1","EUVD-2017-17762","GHSA-g7c7-c6jv-wv5p","MGASA-2017-0444","UBUNTU-CVE-2017-8819","openSUSE-SU-2017:3201-1","openSUSE-SU-2017:3203-1","openSUSE-SU-2024:11469-1"],"status":"published","title":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before...","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01939,"percentile":0.80257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-12-02T14:54:54Z","modified":"2026-09-01T20:03:51Z","fixes":[{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.3.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.3.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.3.1.9-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tor","fixed_in":["0.2.4.27-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tor","fixed_in":["0.2.9.14-1ubuntu1~16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5.16-1"}]}],"versions":["0.2.5.12-1","0.2.5.12-2","0.2.5.12-3","0.2.5.12-4","0.2.5.14-1","0.2.5.15-1"],"bundled":5},{"source":"osv","ecosystem":"Debian:9","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1"}]}],"versions":["0.2.9.10-1","0.2.9.11-1","0.2.9.11-1~bpo8+1","0.2.9.11-1~deb9u1","0.2.9.12-1","0.2.9.12-1~bpo8+1","0.2.9.13-1","0.2.9.14-1~bpo8+1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8.17-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.27-1ubuntu0.1"}]}],"versions":["0.2.3.25-1","0.2.4.19-1","0.2.4.20-1","0.2.4.27-1build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1ubuntu1~16.04.2"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-2.2"}]}],"bundled":22}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"tor_project","product":"tor"}],"references":[{"url":"https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://bugs.torproject.org/24244","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2017/dsa-4054","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8819"},{"url":"https://github.com/advisories/GHSA-g7c7-c6jv-wv5p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8819","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0444.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8819","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1070849","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38385","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-8819","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2017-12-03T07:00:00Z","modified":"2024-08-05T16:48:21.743Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17762","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2017-12-03T07:00:00Z","modified":"2024-08-05T16:48:21Z","updated_at":"2026-11-03T02:23:29.67797Z"}],"ghsa":[{"id":"GHSA-g7c7-c6jv-wv5p","title":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before...","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2022-05-13T01:47:43Z","modified":"2023-02-02T05:01:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:13.974749Z"}],"nvd":[{"id":"CVE-2017-8819","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2017-12-03T07:29:00.303Z","modified":"2026-06-17T01:27:01.157Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"CVE-2017-8819","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2017-12-03T07:29:00.303Z","modified":"2026-04-16T06:16:28.541553225Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8819","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2017-12-03T07:29:00.303Z","modified":"2026-09-01T20:03:51.073652538Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8819","description":"In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.","status":"published","published":"2017-12-03T07:29:00Z","modified":"2025-09-08T16:44:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DSA-4054-1","title":"tor - security update","status":"published","published":"2017-12-03T00:00:00Z","modified":"2026-03-09T01:22:29.827529Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0444","title":"Updated tor packages fix security vulnerability","description":"When checking for replays in the INTRODUCE1 cell data for a (legacy) onion\nservice, Tor didn't correctly detect replays in the RSA- encrypted part of\nthe cell. It was previously checking for replays on the entire cell, but\nthose can be circumvented due to the malleability of Tor's legacy hybrid\nencryption. This can lead to a traffic confirmation attack (CVE-2017-8819).\n\nDenial of service issue where an attacker could crash a directory authority\nusing a malformed router descriptor (CVE-2017-8820).\n\nDenial of service bug where an attacker could use a malformed directory\nobject to cause a Tor instance to pause while OpenSSL would try to read a\npassphrase from the terminal (CVE-2017-8821).\n\nWhen running as a relay, Tor could build a path through itself, especially\nwhen it lost the version of its descriptor appearing in the consensus. When\nrunning as a relay, it could also choose itself as a guard (CVE-2017-8822).\n\nUse-after-free error that could crash v2 Tor onion services when they failed\nto open circuits while expiring introduction points (CVE-2017-8823).\n","status":"published","published":"2017-12-07T20:54:25Z","modified":"2026-04-16T06:24:57.646007729Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2017:3201-1","title":"Security update for tor","description":"This update for tor fixes vulnerabilities that allowed some\ntraffic confirmation, DoS and other attacks (bsc#1070849):\n\n- CVE-2017-8819: Replay-cache ineffective for v2 onion services\n- CVE-2017-8820: Remote DoS attack against directory authorities\n- CVE-2017-8821: An attacker can make Tor ask for a password\n- CVE-2017-8822: Relays can pick themselves in a circuit path\n- CVE-2017-8823: Use-after-free in onion service v2","status":"published","published":"2017-12-02T14:54:54Z","modified":"2026-02-04T03:52:50.129185Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:3203-1","title":"Security update for tor","description":"This update for tor fixes vulnerabilities that allowed some\ntraffic confirmation, DoS and other attacks (bsc#1070849):\n\n- CVE-2017-8819: Replay-cache ineffective for v2 onion services\n- CVE-2017-8820: Remote DoS attack against directory authorities\n- CVE-2017-8821: An attacker can make Tor ask for a password\n- CVE-2017-8822: Relays can pick themselves in a circuit path\n- CVE-2017-8823: Use-after-free in onion service v2","status":"published","published":"2017-12-02T14:54:54Z","modified":"2026-02-04T04:40:28.119077Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11469-1","title":"tor-0.4.6.7-2.2 on GA media","description":"These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:38.644616Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}