CVE-2017-8819: High severity tor browser vulnerability
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8819?
CVE-2017-8819 has a moderate severity rating, allowing attackers to bypass replay-cache protection for v2 onion services.
How do I fix CVE-2017-8819?
To fix CVE-2017-8819, upgrade to Tor version 0.3.5.16-1 or later, or any of the specified secure versions listed in the advisory.
Which versions of Tor are affected by CVE-2017-8819?
CVE-2017-8819 affects Tor versions before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9.
What can attackers do with CVE-2017-8819?
Attackers can exploit CVE-2017-8819 by flooding the system with INTRODUCE2 cells, compromising the security of v2 onion services.
Is there a patch available for CVE-2017-8819?
Yes, patches for CVE-2017-8819 are available in the updated versions of Tor specified in the vulnerability details.