CVE-2021-28089
First published: Fri Mar 19 2021(Updated: )
Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Torproject Tor | <0.3.5.14 | |
| Torproject Tor | >=0.4.4.4<0.4.4.8 | |
| Torproject Tor | >=0.4.5.0<0.4.5.7 | |
| Torproject Tor | =0.4.4.0-alpha | |
| Torproject Tor | =0.4.4.1-alpha | |
| Torproject Tor | =0.4.4.2-alpha | |
| Torproject Tor | =0.4.4.3-alpha | |
| Fedoraproject Fedora | =33 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.torproject.org/node/2009
- https://gitlab.torproject.org/tpo/core/tor/-/issues/40304
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/
- https://security.gentoo.org/glsa/202107-25
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/
Frequently Asked Questions
What is CVE-2021-28089?
CVE-2021-28089 is a vulnerability in Tor before version 0.4.5.7 that allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target.
What is the severity of CVE-2021-28089?
The severity of CVE-2021-28089 is high with a CVSS score of 7.5.
What software versions are affected by CVE-2021-28089?
Versions of Tor up to and including 0.3.5.14, 0.4.4.4 to 0.4.4.8, and 0.4.5.0 to 0.4.5.7 are affected by CVE-2021-28089.
How can a remote participant exhaust CPU resources on a target using CVE-2021-28089?
A remote participant in the Tor directory protocol can exhaust CPU resources on a target by exploiting the vulnerability in Tor before version 0.4.5.7.
How can I fix CVE-2021-28089?
To fix CVE-2021-28089, update Tor to version 0.4.5.7 or later.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/torproject
- canonical/torproject tor
- version/torproject tor/0.4.4.4
- version/torproject tor/0.4.5.0
- version/torproject tor/0.4.4.0-alpha
- version/torproject tor/0.4.4.1-alpha
- version/torproject tor/0.4.4.2-alpha
- version/torproject tor/0.4.4.3-alpha
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33