{"id":"CVE-2021-34548","aliases":["ALPINE-CVE-2021-34548","DEBIAN-CVE-2021-34548","DSA-4932-1","EUVD-2021-21200","GHSA-5hfr-xvmr-9cjw","MGASA-2021-0293","UBUNTU-CVE-2021-34548","USN-5036-1","openSUSE-SU-2021:0926-1","openSUSE-SU-2021:0941-1","openSUSE-SU-2024:11469-1"],"status":"published","title":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge...","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02597,"percentile":0.85466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-863"],"published":"2021-06-18T00:00:00Z","modified":"2026-11-03T06:32:47Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"tor","fixed_in":["0.4.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"tor","fixed_in":["0.4.4.9-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.4.5.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.4.5.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.4.5.9-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","fixed_in":["0.4.2.7-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.4.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.9-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.15-1"}]}],"versions":["0.3.5.10-1","0.3.5.10-1~bpo9+1","0.3.5.12-1","0.3.5.14-1","0.3.5.8-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.15-1.1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.15-1.1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2.7-1ubuntu0.1~esm1"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.27-1ubuntu0.1+esm2"}]}],"versions":["0.2.3.25-1","0.2.4.19-1","0.2.4.20-1","0.2.4.27-1build0.14.04.1","0.2.4.27-1ubuntu0.1","0.2.4.27-1ubuntu0.1+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1ubuntu1~16.04.3+esm1"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.2","0.2.9.14-1ubuntu1~16.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2.10-1ubuntu0.2~esm2"}]}],"versions":["0.3.0.10-1","0.3.1.8-2","0.3.1.9-1","0.3.2.9-1","0.3.2.9-1build1","0.3.2.10-1","0.3.2.10-1ubuntu0.1","0.3.2.10-1ubuntu0.2~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2.7-1ubuntu0.1~esm1"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.9-lp152.2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.9-bp152.2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-2.2"}]}],"bundled":22}],"products":[{"vendor":"torproject","product":"tor"}],"references":[{"url":"https://gitlab.torproject.org/tpo/core/tor/-/issues/40389","tags":["x_refsource_MISC","x_transferred","Broken Link","report"]},{"url":"https://blog.torproject.org/node/2041","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://security.gentoo.org/glsa/202107-25","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34548"},{"url":"https://github.com/advisories/GHSA-5hfr-xvmr-9cjw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-34548","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-34548","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0293.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29136","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29158","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RST7YTNTKJURIR2QVIJMEBXWW2YHETRX/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-34548","tags":["report"]},{"url":"https://bugs.torproject.org/tpo/core/tor/40389","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5036-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38385","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GJI5DAQGLSGJLTAEBDK3BJ65DR3SJHCE/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179331","tags":["report"]},{"url":"https://bugzilla.suse.com/1181244","tags":["report"]},{"url":"https://bugzilla.suse.com/1187322","tags":["report"]},{"url":"https://bugzilla.suse.com/1187323","tags":["report"]},{"url":"https://bugzilla.suse.com/1187324","tags":["report"]},{"url":"https://bugzilla.suse.com/1187325","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34550","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/553MAZKSU2F6B7N6LTWA5YMHITLEL3HL/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38385","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-34548","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:00:16Z","modified":"2024-08-04T00:12:50.422Z","updated_at":"2026-11-02T14:33:11.244759Z"}],"euvd":[{"id":"EUVD-2021-21200","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:00:16Z","modified":"2024-08-04T00:12:50Z","updated_at":"2026-11-03T03:24:32.445199Z"}],"ghsa":[{"id":"GHSA-5hfr-xvmr-9cjw","title":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge...","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2022-05-24T19:06:33Z","modified":"2023-08-17T05:02:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:45.82233Z"}],"nvd":[{"id":"CVE-2021-34548","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:15:07.883Z","modified":"2026-06-17T03:56:06.207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"ALPINE-CVE-2021-34548","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:15:07.883Z","modified":"2026-11-03T06:32:47.472432078Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-34548","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:15:07.883Z","modified":"2026-10-24T10:30:25.876710498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-34548","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:15:07.883Z","modified":"2026-10-23T18:04:50.696316805Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-34548","description":"An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.","status":"published","published":"2021-06-29T11:15:00Z","modified":"2026-02-04T02:50:55.163602Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"DSA-4932-1","title":"tor - security update","status":"published","published":"2021-06-18T00:00:00Z","modified":"2026-03-09T02:10:03.854123Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0293","title":"Updated tor package fixes security vulnerabilities","description":"Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on half-closed\nstreams. Previously, clients failed to validate which hop sent these cells:\nthis would allow a relay on a circuit to end a stream that wasn't actually\nbuilt with it (CVE-2021-34548).\n\nhashtable-based CPU denial-of-service attack against relays (CVE-2021-34549). \n\nout-of-bounds memory access in v3 onion service descriptor parsing\n(CVE-2021-34550).\n\nSee also upstream release notes for included other bugfixes.\n\nThis package also fixes an error in tor package's un-install script (mga#29158).\n","status":"published","published":"2021-06-28T21:16:35Z","modified":"2026-04-16T04:43:17.098932728Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0926-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor 0.4.5.9\n\n* Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell (CVE-2021-34548, boo#1187322)\n* Detect more failure conditions from the OpenSSL RNG code (boo#1187323)\n* Resist a hashtable-based CPU denial-of-service attack against relays (CVE-2021-34549, boo#1187324)\n* Fix an out-of-bounds memory access in v3 onion service descriptor parsing (CVE-2021-34550, boo#1187325)\n\ntor 0.4.5.8\n\n* https://lists.torproject.org/pipermail/tor-announce/2021-May/000219.html\n* allow Linux sandbox with Glibc 2.33\n* work with autoconf 2.70+\n* several other minor features and bugfixes (see announcement)\n\n- Fix logging issue due to systemd picking up stdout - boo#1181244\n  Continue to log notices to syslog by default.\n","status":"published","published":"2021-06-25T18:34:10Z","modified":"2026-02-04T04:15:03.455848Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0941-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor 0.4.5.9\n\n* Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell (CVE-2021-34548, boo#1187322)\n* Detect more failure conditions from the OpenSSL RNG code (boo#1187323)\n* Resist a hashtable-based CPU denial-of-service attack against relays (CVE-2021-34549, boo#1187324)\n* Fix an out-of-bounds memory access in v3 onion service descriptor parsing (CVE-2021-34550, boo#1187325)\n\ntor 0.4.5.8\n\n* https://lists.torproject.org/pipermail/tor-announce/2021-May/000219.html\n* allow Linux sandbox with Glibc 2.33\n* work with autoconf 2.70+\n* several other minor features and bugfixes (see announcement)\n\n- Fix logging issue due to systemd picking up stdout - boo#1181244\n  Continue to log notices to syslog by default.\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-06-29T08:06:38Z","modified":"2026-02-04T03:05:12.33145Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11469-1","title":"tor-0.4.6.7-2.2 on GA media","description":"These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:38.644616Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5036-1","title":"tor vulnerabilities","description":"It was discovered that Tor incorrectly handled certain memory operations. A\nremote attacker could use this issue to cause a denial of service. This issue\nonly affected Ubuntu 18.04 ESM. (CVE-2019-8955)\n\nIt was discovered that Tor did not properly handle the input length to\ndump_desc() function. A remote attacker could use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2021-28089)\n\nIt was discovered that Tor did not properly sanitize the relay nickname in\ndirvote_add_signatures_to_pending_consensus() function. An attacker could\npossibly use this issue to cause an assertion failure and then cause a denial\nof service. (CVE-2021-28090)\n\nIt was discovered that Tor did not properly validate the layer hint on\nhalf-open streams. A remote attacker could possibly use this issue to bypass\nthe access control, leading to remote code execution. This issue only affected\nUbuntu 20.04 ESM. (CVE-2021-34548)\n\nIt was discovered that Tor was using an insecure hash function. A remote\nattacker could use this issue to cause a denial of service. This issue only\naffected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2021-34549)\n\nIt was discovered that Tor did not properly manage memory under certain\ncircumstances. If a user were tricked into opening a specially crafted request,\na remote attacker could possibly use this issue to cause a crash, resulting in\na denial of service, or possibly reading sensitive data. This issue only\naffected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34550)\n\nIt was discovered that Tor mishandles the relationship between batch-signature\nverification and single-signature verification. An attacker could possibly use\nthis issue to cause an assertion failure and then cause a denial of service.\nThis issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04\nESM. (CVE-2021-38385)\n","status":"published","published":"2022-10-04T11:04:57Z","modified":"2026-06-29T13:49:26.448825711Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}