{"id":"CVE-2021-38385","aliases":["ALPINE-CVE-2021-38385","DEBIAN-CVE-2021-38385","DSA-4961-1","EUVD-2021-24837","GHSA-jh9r-c248-cvw6","MGASA-2021-0426","UBUNTU-CVE-2021-38385","USN-5036-1","openSUSE-SU-2021:1169-1","openSUSE-SU-2021:1178-1","openSUSE-SU-2021:1192-1","openSUSE-SU-2024:11469-1"],"status":"published","title":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature...","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01685,"percentile":0.77193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2021-08-19T15:21:48Z","modified":"2026-11-03T06:32:58Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"tor","fixed_in":["0.4.5.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tor","fixed_in":["0.4.6.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.4.5.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.4.5.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.4.5.10-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"tor","fixed_in":["0.3.5.16-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"tor","fixed_in":["0.4.5.10-1~deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"tor","fixed_in":["0.3.5.16-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","fixed_in":["0.2.9.14-1ubuntu1~16.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","fixed_in":["0.3.2.10-1ubuntu0.2~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","fixed_in":["0.4.2.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"tor","fixed_in":["0.4.6.7-lp152.2.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"tor","fixed_in":["0.4.6.7-bp152.2.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"tor","fixed_in":["0.4.6.7-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"tor","fixed_in":["0.4.6.7-bp153.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.5.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0.0"},{"fixed":"0.4.6.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.10-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.16-1"}]}],"versions":["0.3.5.10-1","0.3.5.10-1~bpo9+1","0.3.5.12-1","0.3.5.14-1","0.3.5.15-1","0.3.5.8-1"]},{"source":"osv","ecosystem":"Debian:11","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5.10-1~deb11u1"}]}],"versions":["0.4.5.10-1~bpo10+1","0.4.5.9-1"]},{"source":"osv","ecosystem":"Mageia:8","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5.16-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1ubuntu1~16.04.3+esm1"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.2","0.2.9.14-1ubuntu1~16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2.10-1ubuntu0.2~esm2"}]}],"versions":["0.3.0.10-1","0.3.1.8-2","0.3.1.9-1","0.3.2.9-1","0.3.2.9-1build1","0.3.2.10-1","0.3.2.10-1ubuntu0.1","0.3.2.10-1ubuntu0.2~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2.7-1ubuntu0.1~esm1"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4.27-1ubuntu0.1+esm2"}]}],"versions":["0.2.3.25-1","0.2.4.19-1","0.2.4.20-1","0.2.4.27-1build0.14.04.1","0.2.4.27-1ubuntu0.1","0.2.4.27-1ubuntu0.1+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9.14-1ubuntu1~16.04.3+esm1"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.2","0.2.9.14-1ubuntu1~16.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2.10-1ubuntu0.2~esm2"}]}],"versions":["0.3.0.10-1","0.3.1.8-2","0.3.1.9-1","0.3.2.9-1","0.3.2.9-1build1","0.3.2.10-1","0.3.2.10-1ubuntu0.1","0.3.2.10-1ubuntu0.2~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2.7-1ubuntu0.1~esm1"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-lp152.2.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-bp152.2.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-2.2"}]}],"bundled":22}],"products":[{"vendor":"torproject","product":"tor"}],"references":[{"url":"https://blog.torproject.org","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://blog.torproject.org/node/2062","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://bugs.torproject.org/tpo/core/tor/40078","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://security.gentoo.org/glsa/202305-11","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38385"},{"url":"https://github.com/advisories/GHSA-jh9r-c248-cvw6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-38385","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38385","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0426.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29377","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PMWWIBVBPI5X7QIC5VO3NJURIXL33ROT/","tags":["web","advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38385","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5036-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34550","tags":["report"]},{"url":"https://bugzilla.suse.com/1189489","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38385","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UHRGW223LHWDOY266A75KETVX3MXPUIF/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IZNA4UBO42ISVK2GMMR2H5RCFMPHLYVV/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34550","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-38385","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T00:00:00Z","modified":"2024-08-04T01:37:16.635Z","updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-24837","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T00:00:00Z","modified":"2024-08-04T01:37:16Z","updated_at":"2026-11-03T03:24:25.244479Z"}],"ghsa":[{"id":"GHSA-jh9r-c248-cvw6","title":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature...","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2022-05-24T19:12:33Z","modified":"2023-05-12T05:00:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:54:35.559556Z"}],"nvd":[{"id":"CVE-2021-38385","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T05:15:07.237Z","modified":"2026-06-17T04:01:59.753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"ALPINE-CVE-2021-38385","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T05:15:07.237Z","modified":"2026-11-03T06:32:58.579615413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2021-38385","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T05:15:07.237Z","modified":"2026-10-24T10:31:05.879508319Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-38385","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T05:15:07.237Z","modified":"2026-10-23T18:03:31.823085417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"UBUNTU-CVE-2021-38385","description":"Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.","status":"published","published":"2021-08-30T05:15:00Z","modified":"2026-02-04T04:16:58.159342Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"DSA-4961-1","title":"tor - security update","status":"published","published":"2021-08-23T00:00:00Z","modified":"2026-03-09T02:10:20.263214Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0426","title":"Updated tor packages fix security vulnerability","description":"Henry de Valence reported a flaw in the signature verification code in Tor,\na connection-based low-latency anonymous communication system. A remote\nattacker can take advantage of this flaw to cause an assertion failure,\nresulting in denial of service.\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:41:02.804356964Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1169-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor 0.4.6.7:\n\n* Fix a DoS via a remotely triggerable assertion failure\n  (boo#1189489, TROVE-2021-007, CVE-2021-38385)\n\ntor 0.4.6.6:\n\n* Fix a compilation error with gcc 7, drop tor-0.4.6.5-gcc7.patch\n* Enable the deterministic RNG for unit tests that covers the\n  address set bloomfilter-based API's\n\ntor 0.4.6.5\n\n* Add controller support for creating v3 onion services with\n  client auth\n* When voting on a relay with a Sybil-like appearance, add the\n  Sybil flag when clearing out the other flags. This lets a relay\n  operator know why their relay hasn't been included in the\n  consensus\n* Relays now report how overloaded they are\n* Add a new DoS subsystem to control the rate of client\n  connections for relays\n* Relays now publish statistics about v3 onions services\n* Improve circuit timeout algorithm for client performance\n","status":"published","published":"2021-08-19T15:21:48Z","modified":"2026-02-04T02:29:55.794763Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1178-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor 0.4.6.7:\n\n* Fix a DoS via a remotely triggerable assertion failure\n  (boo#1189489, TROVE-2021-007, CVE-2021-38385)\n\ntor 0.4.6.6:\n\n* Fix a compilation error with gcc 7, drop tor-0.4.6.5-gcc7.patch\n* Enable the deterministic RNG for unit tests that covers the\n  address set bloomfilter-based API's\n\ntor 0.4.6.5\n\n* Add controller support for creating v3 onion services with\n  client auth\n* When voting on a relay with a Sybil-like appearance, add the\n  Sybil flag when clearing out the other flags. This lets a relay\n  operator know why their relay hasn't been included in the\n  consensus\n* Relays now report how overloaded they are\n* Add a new DoS subsystem to control the rate of client\n  connections for relays\n* Relays now publish statistics about v3 onions services\n* Improve circuit timeout algorithm for client performance\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-08-22T22:06:30Z","modified":"2026-02-04T03:33:23.386969Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1192-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor 0.4.6.7:\n\n* Fix a DoS via a remotely triggerable assertion failure\n  (boo#1189489, TROVE-2021-007, CVE-2021-38385)\n\ntor 0.4.6.6:\n\n* Enable the deterministic RNG for unit tests that covers the\n  address set bloomfilter-based API's\n\ntor 0.4.6.5\n\n* Add controller support for creating v3 onion services with\n  client auth\n* When voting on a relay with a Sybil-like appearance, add the\n  Sybil flag when clearing out the other flags. This lets a relay\n  operator know why their relay hasn't been included in the\n  consensus\n* Relays now report how overloaded they are\n* Add a new DoS subsystem to control the rate of client\n  connections for relays\n* Relays now publish statistics about v3 onions services\n* Improve circuit timeout algorithm for client performance\n","status":"published","published":"2021-08-25T15:57:20Z","modified":"2026-02-04T03:41:48.149857Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11469-1","title":"tor-0.4.6.7-2.2 on GA media","description":"These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:38.644616Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5036-1","title":"tor vulnerabilities","description":"It was discovered that Tor incorrectly handled certain memory operations. A\nremote attacker could use this issue to cause a denial of service. This issue\nonly affected Ubuntu 18.04 ESM. (CVE-2019-8955)\n\nIt was discovered that Tor did not properly handle the input length to\ndump_desc() function. A remote attacker could use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2021-28089)\n\nIt was discovered that Tor did not properly sanitize the relay nickname in\ndirvote_add_signatures_to_pending_consensus() function. An attacker could\npossibly use this issue to cause an assertion failure and then cause a denial\nof service. (CVE-2021-28090)\n\nIt was discovered that Tor did not properly validate the layer hint on\nhalf-open streams. A remote attacker could possibly use this issue to bypass\nthe access control, leading to remote code execution. This issue only affected\nUbuntu 20.04 ESM. (CVE-2021-34548)\n\nIt was discovered that Tor was using an insecure hash function. A remote\nattacker could use this issue to cause a denial of service. This issue only\naffected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2021-34549)\n\nIt was discovered that Tor did not properly manage memory under certain\ncircumstances. If a user were tricked into opening a specially crafted request,\na remote attacker could possibly use this issue to cause a crash, resulting in\na denial of service, or possibly reading sensitive data. This issue only\naffected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-34550)\n\nIt was discovered that Tor mishandles the relationship between batch-signature\nverification and single-signature verification. An attacker could possibly use\nthis issue to cause an assertion failure and then cause a denial of service.\nThis issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04\nESM. (CVE-2021-38385)\n","status":"published","published":"2022-10-04T11:04:57Z","modified":"2026-06-29T13:49:26.448825711Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}