CVE-2021-28090
First published: Fri Mar 19 2021(Updated: )
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Torproject Tor | <0.3.5.14 | |
| Torproject Tor | >=0.4.4.4<0.4.4.8 | |
| Torproject Tor | >=0.4.5.0<0.4.5.7 | |
| Torproject Tor | =0.4.4.0-alpha | |
| Torproject Tor | =0.4.4.1-alpha | |
| Torproject Tor | =0.4.4.2-alpha | |
| Torproject Tor | =0.4.4.3-alpha | |
| Fedoraproject Fedora | =33 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.torproject.org/node/2009
- https://bugs.torproject.org/tpo/core/tor/40316
- https://gitlab.torproject.org/tpo/core/tor/-/issues/40316
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/
- https://security.gentoo.org/glsa/202107-25
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/
Frequently Asked Questions
What is CVE-2021-28090?
CVE-2021-28090 is a vulnerability in Tor before 0.4.5.7 that allows a remote attacker to cause Tor directory authorities to exit with an assertion failure.
How does CVE-2021-28090 affect Tor?
CVE-2021-28090 affects Tor versions before 0.4.5.7.
What is the severity of CVE-2021-28090?
The severity of CVE-2021-28090 is medium with a CVSS score of 5.3.
How can I fix CVE-2021-28090?
To fix CVE-2021-28090, update Tor to version 0.4.5.7 or later.
Where can I find more information about CVE-2021-28090?
You can find more information about CVE-2021-28090 on the Tor Project blog, Tor Project bug tracker, and Tor Project GitLab.
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/torproject
- canonical/torproject tor
- version/torproject tor/0.4.4.4
- version/torproject tor/0.4.5.0
- version/torproject tor/0.4.4.0-alpha
- version/torproject tor/0.4.4.1-alpha
- version/torproject tor/0.4.4.2-alpha
- version/torproject tor/0.4.4.3-alpha
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33