VulnerabilityModified

CVE-2020-8516

The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information.

MEDIUM 5.3EPSS 2.50%

Does this matter?

Lower severity and a low EPSS score (2.50%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 2.50% probability · 84th percentile
CISA KEV: Not listed
Affected: torproject/tor
Source: cve@mitre.org

References

https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.htmlMailing List, Vendor Advisory
https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.htmlMailing List, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2020-8516Third Party Advisory
https://trac.torproject.org/projects/tor/ticket/33129Issue Tracking, Vendor Advisory
https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.htmlExploit, Mitigation, Technical Description, Third Party Advisory
https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.htmlMailing List, Vendor Advisory
https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.htmlMailing List, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2020-8516Third Party Advisory
https://trac.torproject.org/projects/tor/ticket/33129Issue Tracking, Vendor Advisory
https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.htmlExploit, Mitigation, Technical Description, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.