CVE-2013-7295
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
55.4%
Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| torproject | tor | * | cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* |
| torproject | tor | 0.2.4.1 | cpe:2.3:a:torproject:tor:0.2.4.1:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.2 | cpe:2.3:a:torproject:tor:0.2.4.2:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.3 | cpe:2.3:a:torproject:tor:0.2.4.3:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.4 | cpe:2.3:a:torproject:tor:0.2.4.4:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.5 | cpe:2.3:a:torproject:tor:0.2.4.5:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.6 | cpe:2.3:a:torproject:tor:0.2.4.6:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.7 | cpe:2.3:a:torproject:tor:0.2.4.7:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.8 | cpe:2.3:a:torproject:tor:0.2.4.8:alpha:*:*:*:*:*:* |
| torproject | tor | 0.2.4.9 | cpe:2.3:a:torproject:tor:0.2.4.9:alpha:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
55.4%