Lucene search

GitHub Advisory DatabaseGHSA-C96H-CXX6-RMG9

HistoryMay 18, 2024 - 12:30 a.m.

Tor path lengths too short when "full Vanguards" configured

2024-05-1800:30:42

CWE-754

GitHub Advisory Database

github.com

tor arti

path length

full vanguards

trove-2024-004

software

7.1 High

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.

Affected configurations

Vulners

Node

github_advisory_databaseartiMatch1.2.2

tortorMatch0.18.0

CPENameOperatorVersion
artieq1.2.2
tor-circmgreq0.18.0

CPE	Name	Operator	Version
	arti	eq	1.2.2
	tor-circmgr	eq	0.18.0

References

github.com/advisories/GHSA-c96h-cxx6-rmg9

gitlab.torproject.org/tpo/core/arti/-/blob/main/CHANGELOG.md#arti-123-15-may-2024

gitlab.torproject.org/tpo/core/arti/-/commit/1a89d5c9659d799a84dd3ff00fae530f5c8ba280

gitlab.torproject.org/tpo/core/arti/-/issues/1400

gitlab.torproject.org/tpo/core/arti/-/issues/1409

gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

nvd.nist.gov/vuln/detail/CVE-2024-35313

rustsec.org/advisories/RUSTSEC-2024-0339.html

rustsec.org/advisories/RUSTSEC-2024-0340.html