{"id":"CVE-2021-28090","aliases":["ALPINE-CVE-2021-28090","DEBIAN-CVE-2021-28090","DSA-4871-1","EUVD-2021-14795","GHSA-79hx-qq8c-36qm","MGASA-2021-0180","UBUNTU-CVE-2021-28090","USN-5036-1","openSUSE-SU-2021:0461-1","openSUSE-SU-2021:0474-1","openSUSE-SU-2024:11469-1"],"status":"published","title":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an...","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02096,"percentile":0.81804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2021-03-16T00:00:00Z","modified":"2026-11-03T06:32:27Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"tor","fixed_in":["0.3.5.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"tor","fixed_in":["0.4.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"tor","fixed_in":["0.4.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"tor","fixed_in":["0.4.4.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tor","fixed_in":["0.4.5.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.4.5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.4.5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.4.5.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tor","fixed_in":["0.2.4.27-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","fixed_in":["0.2.9.14-1ubuntu1~16.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","fixed_in":["0.3.2.10-1ubuntu0.2~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","fixed_in":["0.4.2.7-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.3.5.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.4.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.4.4"},{"fixed":"0.4.5.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.14-1"}]}],"versions":["0.3.5.10-1","0.3.5.10-1~bpo9+1","0.3.5.12-1","0.3.5.8-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.14-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.14-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.27-1ubuntu0.1+esm2"}]}],"versions":["0.2.3.25-1","0.2.4.19-1","0.2.4.20-1","0.2.4.27-1build0.14.04.1","0.2.4.27-1ubuntu0.1","0.2.4.27-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1ubuntu1~16.04.3+esm1"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.2","0.2.9.14-1ubuntu1~16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2.10-1ubuntu0.2~esm2"}]}],"versions":["0.3.0.10-1","0.3.1.8-2","0.3.1.9-1","0.3.2.9-1","0.3.2.9-1build1","0.3.2.10-1","0.3.2.10-1ubuntu0.1","0.3.2.10-1ubuntu0.2~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2.7-1ubuntu0.1~esm1"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.27-1ubuntu0.1+esm2"}]}],"versions":["0.2.3.25-1","0.2.4.19-1","0.2.4.20-1","0.2.4.27-1build0.14.04.1","0.2.4.27-1ubuntu0.1","0.2.4.27-1ubuntu0.1+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1ubuntu1~16.04.3+esm1"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.2","0.2.9.14-1ubuntu1~16.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2.10-1ubuntu0.2~esm2"}]}],"versions":["0.3.0.10-1","0.3.1.8-2","0.3.1.9-1","0.3.2.9-1","0.3.2.9-1build1","0.3.2.10-1","0.3.2.10-1ubuntu0.1","0.3.2.10-1ubuntu0.2~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2.7-1ubuntu0.1~esm1"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.7-lp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.7-bp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-2.2"}]}],"bundled":22}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"torproject","product":"tor"}],"references":[{"url":"https://gitlab.torproject.org/tpo/core/tor/-/issues/40316","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://blog.torproject.org/node/2009","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://bugs.torproject.org/tpo/core/tor/40316","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202107-25","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28090"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"},{"url":"https://github.com/advisories/GHSA-79hx-qq8c-36qm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28090","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28090","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0180.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28090","tags":["report"]},{"url":"https://gitlab.torproject.org/tpo/core/tor/-/commit/890ae4fb1adfa13e37aaf5261e089e8c195a75cf","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5036-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38385","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XSB44OD563RNCPQDPKFNUKGO3WVL7M4V/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28090","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/D34QNXQE32JN77ED4VWLDVQOC4MRKET6/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38385","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28090","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T04:19:06Z","modified":"2024-08-03T21:33:17.495Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-14795","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T04:19:06Z","modified":"2024-08-03T21:33:17Z","updated_at":"2026-11-03T03:24:47.80549Z"}],"ghsa":[{"id":"GHSA-79hx-qq8c-36qm","title":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an...","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2022-05-24T17:44:57Z","modified":"2023-01-29T05:06:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T14:45:56.584389Z"}],"nvd":[{"id":"CVE-2021-28090","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T05:15:12.87Z","modified":"2026-06-17T03:45:47.713Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"ALPINE-CVE-2021-28090","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T05:15:12.87Z","modified":"2026-11-03T06:32:27.888509149Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2021-28090","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T05:15:12.87Z","modified":"2026-10-24T10:50:41.354442099Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28090","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T05:15:12.87Z","modified":"2026-10-23T18:03:12.08832353Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-28090","description":"Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.","status":"published","published":"2021-03-19T05:15:00Z","modified":"2026-02-04T02:39:07.607798Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DSA-4871-1","title":"tor - security update","status":"published","published":"2021-03-16T00:00:00Z","modified":"2026-03-09T02:11:38.283974Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0180","title":"Updated tor packages fix security vulnerabilities","description":"The dump_desc() function that we used to dump unparseable information to disk,\nwas called incorrectly in several places, in a way that could lead to excessive\nCPU usage (CVE-2021-28089).\n\nA bug in appending detached signatures to a pending consensus document could be\nused to crash a directory authority (CVE-2021-28090).\n","status":"published","published":"2021-04-12T19:59:59Z","modified":"2026-04-16T04:41:19.592131002Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0461-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor was updated to 0.4.5.7\n\n* https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html\n* Fix 2 denial of service security issues (boo#1183726)\n  + Disable the dump_desc() function that we used to dump unparseable\n    information to disk (CVE-2021-28089)\n  + Fix a bug in appending detached signatures to a pending consensus\n    document that could be used to crash a directory authority\n    (CVE-2021-28090)\n* Ship geoip files based on the IPFire Location Database\n","status":"published","published":"2021-03-21T23:09:43Z","modified":"2026-02-04T02:47:08.946163Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0474-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor was updated to 0.4.5.7\n\n* https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html\n* Fix 2 denial of service security issues (boo#1183726)\n  + Disable the dump_desc() function that we used to dump unparseable\n    information to disk (CVE-2021-28089)\n  + Fix a bug in appending detached signatures to a pending consensus\n    document that could be used to crash a directory authority\n    (CVE-2021-28090)\n* Ship geoip files based on the IPFire Location Database\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-03-25T11:07:12Z","modified":"2026-02-04T04:13:27.134736Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11469-1","title":"tor-0.4.6.7-2.2 on GA media","description":"These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:38.644616Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5036-1","title":"tor vulnerabilities","description":"It was discovered that Tor incorrectly handled certain memory operations. A\nremote attacker could use this issue to cause a denial of service. This issue\nonly affected Ubuntu 18.04 ESM. (CVE-2019-8955)\n\nIt was discovered that Tor did not properly handle the input length to\ndump_desc() function. A remote attacker could use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2021-28089)\n\nIt was discovered that Tor did not properly sanitize the relay nickname in\ndirvote_add_signatures_to_pending_consensus() function. An attacker could\npossibly use this issue to cause an assertion failure and then cause a denial\nof service. (CVE-2021-28090)\n\nIt was discovered that Tor did not properly validate the layer hint on\nhalf-open streams. A remote attacker could possibly use this issue to bypass\nthe access control, leading to remote code execution. This issue only affected\nUbuntu 20.04 ESM. (CVE-2021-34548)\n\nIt was discovered that Tor was using an insecure hash function. A remote\nattacker could use this issue to cause a denial of service. This issue only\naffected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2021-34549)\n\nIt was discovered that Tor did not properly manage memory under certain\ncircumstances. If a user were tricked into opening a specially crafted request,\na remote attacker could possibly use this issue to cause a crash, resulting in\na denial of service, or possibly reading sensitive data. This issue only\naffected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34550)\n\nIt was discovered that Tor mishandles the relationship between batch-signature\nverification and single-signature verification. An attacker could possibly use\nthis issue to cause an assertion failure and then cause a denial of service.\nThis issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04\nESM. (CVE-2021-38385)\n","status":"published","published":"2022-10-04T11:04:57Z","modified":"2026-06-29T13:49:26.448825711Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}