VDB
CVE-2017-8822
CVE-2017-8822
PUBLISHED
CVSS 3.700000047683716 LOW
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.
EPSS 0.90% · 59.6th percentile
Risk Scores
CVSS 3.0
3.700000047683716
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.90%
59.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | tor | 0.2.7.6-1ubuntu1, 0.2.9.11-1ubuntu1~16.04.1, 0.2.9.14-1ubuntu1~16.04.1 |
| Ubuntu:14.04:LTS | tor | 0, 0.2.3.25-1, 0.2.4.19-1 |
Timeline
- Dec 2, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 26, 2021 EPSS Score
- Oct 28, 2021 EPSS Score
- Dec 31, 2021 EPSS Score
- Mar 4, 2022 EPSS Score
- May 7, 2022 EPSS Score
- Jul 9, 2022 EPSS Score
- Nov 14, 2022 EPSS Score
- Jan 17, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://bugs.torproject.org/21534 third-party-advisory
- https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-8822 third-party-advisory
- https://ubuntu.com/security/CVE-2017-8822 advisory