CVE-2021-34549

Summary

CVE	CVE-2021-34549
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-06-29 12:15:00 UTC
Updated	2022-07-12 17:42:00 UTC
Description	An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.

Risk And Classification

Problem Types: CWE-400

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Torproject	Tor	All	All	All	All

References

Reference	Source	Link	Tags
Not Found	MISC	gitlab.torproject.org
Tor: Multiple vulnerabilities (GLSA 202107-25) — Gentoo security	GENTOO	security.gentoo.org
New stable security releases: 0.3.5.15, 0.4.4.9, 0.4.5.9, 0.4.6.5 \| Tor Blog	CONFIRM	blog.torproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

178676 Debian Security Update for tor (DSA 4932-1)
180452 Debian Security Update for tor (CVE-2021-34549)
281659 Fedora Security Update for tor (FEDORA-2021-ff4ad9825a)
281660 Fedora Security Update for tor (FEDORA-2021-1b60c984e5)
501260 Alpine Linux Security Update for tor
710051 Gentoo Linux Tor Multiple vulnerabilities (GLSA 202107-25)
750726 OpenSUSE Security Update for tor (openSUSE-SU-2021:0926-1)