CVE-2021-21323: Regression in DNS leakage from Tor windows
Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-21323?
CVE-2021-21323 is a vulnerability in Brave web browser versions 1.17.73-1.20.103 that allows DNS requests to bypass the Brave Tor proxy.
How does the CVE-2021-21323 vulnerability affect Brave web browser?
The CVE-2021-21323 vulnerability in Brave web browser versions 1.17.73-1.20.103 allows DNS requests to bypass the Brave Tor proxy if adblocking is enabled.
What is the severity of CVE-2021-21323?
The severity of CVE-2021-21323 is medium with a CVSS score of 5.3.
How can I fix the CVE-2021-21323 vulnerability in Brave web browser?
To fix the CVE-2021-21323 vulnerability, update Brave web browser to a version higher than 1.20.103.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-21323?
The Common Weakness Enumeration (CWE) ID for CVE-2021-21323 is 200.