CVE-2017-8819
First published: Sun Dec 03 2017(Updated: )
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/tor | 0.3.5.16-1 0.3.5.16-1+deb10u1 0.4.5.16-1 0.4.7.13-1 0.4.8.7-1 | |
| Tor Browser | <0.2.5.16 | |
| Tor Browser | >=0.2.6<0.2.8.17 | |
| Tor Browser | >=0.2.9<0.2.9.14 | |
| Tor Browser | >=0.3.0<0.3.0.13 | |
| Tor Browser | >=0.3.1<0.3.1.9 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-8819?
CVE-2017-8819 has a moderate severity rating, allowing attackers to bypass replay-cache protection for v2 onion services.
How do I fix CVE-2017-8819?
To fix CVE-2017-8819, upgrade to Tor version 0.3.5.16-1 or later, or any of the specified secure versions listed in the advisory.
Which versions of Tor are affected by CVE-2017-8819?
CVE-2017-8819 affects Tor versions before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9.
What can attackers do with CVE-2017-8819?
Attackers can exploit CVE-2017-8819 by flooding the system with INTRODUCE2 cells, compromising the security of v2 onion services.
Is there a patch available for CVE-2017-8819?
Yes, patches for CVE-2017-8819 are available in the updated versions of Tor specified in the vulnerability details.
- collector/security-tracker-debian
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/tor project
- canonical/tor browser
- version/tor browser/0.2.6
- version/tor browser/0.2.9
- version/tor browser/0.3.0
- version/tor browser/0.3.1
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0