{"id":"CVE-2022-33903","aliases":["ALPINE-CVE-2022-33903","DEBIAN-CVE-2022-33903","EUVD-2022-36940","GHSA-g7xf-5c64-42cx","openSUSE-SU-2022:10023-1","openSUSE-SU-2024:12149-1"],"status":"published","title":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01334,"percentile":0.71535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-06-22T19:02:23Z","modified":"2026-11-03T07:30:38Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tor","fixed_in":["0.4.7.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.4.7.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.4.7.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.4.7.8-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"tor","fixed_in":["0.4.7.8-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"tor","fixed_in":["0.4.7.8-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"tor","fixed_in":["0.4.7.8-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tor","fixed_in":["0.4.7.8-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tor","fixed_in":["0.4.7.8-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7.1"},{"fixed":"0.4.7.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7.8-1.1"}]}]}],"products":[{"vendor":"torproject","product":"tor"}],"references":[{"url":"https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html","tags":["x_transferred","Mailing List","Patch","Vendor Advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-33903","tags":["x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://security.gentoo.org/glsa/202305-11","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33903","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g7xf-5c64-42cx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-33903","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33903.json","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NKHAXM5C4XR2I62FUPOANDEWE7DEFBS6/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200672","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-33903","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-33903","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-17T00:00:00Z","modified":"2024-08-03T08:09:22.727Z","updated_at":"2026-11-02T14:34:40.275153Z"}],"euvd":[{"id":"EUVD-2022-36940","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-17T00:00:00Z","modified":"2024-08-03T08:09:22Z","updated_at":"2026-11-03T03:25:29.68115Z"}],"ghsa":[{"id":"GHSA-g7xf-5c64-42cx","title":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-18T00:00:31Z","modified":"2023-05-03T12:30:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:54:34.500941Z"}],"nvd":[{"id":"CVE-2022-33903","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-17T23:15:09.103Z","modified":"2026-06-17T04:49:27.56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"ALPINE-CVE-2022-33903","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-17T23:15:09.103Z","modified":"2026-11-03T07:30:38.041149961Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"DEBIAN-CVE-2022-33903","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-17T23:15:09.103Z","modified":"2026-11-03T08:03:00.802339859Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"CVE-2022-33903","description":"Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.","status":"published","published":"2022-07-17T00:00:00Z","modified":"2026-10-28T02:30:59.410446816Z","updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"openSUSE-SU-2022:10023-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\ntor was updated to 0.4.7.8:\n\n* Fix a scenario where RTT estimation can become wedged, seriously\n  degrading congestion control performance on all circuits. This\n  impacts clients, onion services, and relays, and can be triggered\n  remotely by a malicious endpoint.\n  (TROVE-2022-001, CVE-2022-33903, boo#1200672)\n* Regenerate fallback directories generated on June 17, 2022.\n* Update the geoip files to match the IPFire Location Database, as\n  retrieved on 2022/06/17.\n* Allow the rseq system call in the sandbox\n* logging bug fixes\n","status":"published","published":"2022-06-22T19:02:23Z","modified":"2025-05-07T18:14:09.814041Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12149-1","title":"tor-0.4.7.8-1.1 on GA media","description":"These are all security issues fixed in the tor-0.4.7.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:19.549556Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}