CVE-2020-10593: High severity torproject Tor vulnerability
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpadsetupmachineoncirc because a circuit-padding machine can be negotiated twice on the same circuit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/torto a version that resolves this vulnerability.Fixed in 0.3.5.10-r0 - Upgrade
Upgrade
alpine/torto a version that resolves this vulnerability.Fixed in 0.4.4.9-r0 - Upgrade
Upgrade
alpine/torto a version that resolves this vulnerability.Fixed in 0.4.2.7-r0
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-10593.
What is the severity of CVE-2020-10593?
The severity of CVE-2020-10593 is high with a score of 7.5.
What is the affected software?
The affected software is Tor versions before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7.
What is the impact of this vulnerability?
This vulnerability allows remote attackers to cause a Denial of Service through a memory leak.
How can I fix CVE-2020-10593?
To fix CVE-2020-10593, update Tor to version 0.3.5.10, 0.4.1.9, or 0.4.2.7.