Tor - Security Update (DSA-2993-1)
Summary
DSA-2993-1: tor - security update. Affects tor versions < 0.2.4.23-1~deb7u1. Fixed in 0.2.4.23-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tor is a connection-based low-latency anonymous communication system. It provides a means for users to browse the internet anonymously by routing their traffic through a network of relays. Tor is widely used by individuals and organizations seeking to protect their privacy and evade censorship.
Vulnerability Detail
The DSA-2993-1 vulnerability in Tor is a security issue that allows colluding relays on the network to tag user circuits and deploy traffic confirmation attacks. This attack can compromise the anonymity of Tor users and potentially expose their sensitive information. Additionally, a bug in the bounds-checking of the curve25519-donna implementation could cause incorrect results on 32-bit implementations, potentially distinguishing them from 64-bit implementations.
How To Fix
Minimum fixed version
0.2.4.23-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade torTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
The DSA-2993-1 vulnerability in Tor poses a significant risk to the anonymity and privacy of Tor users. It is crucial to upgrade to the fixed versions of Tor to mitigate the risk of traffic confirmation attacks and potential information leaks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tor →
FAQ
Tor is a connection-based low-latency anonymous communication system that allows users to browse the internet anonymously by routing their traffic through a network of relays.
A traffic confirmation attack is a method used by colluding relays on the Tor network to tag user circuits and potentially compromise the anonymity of Tor users.
You can use Vulert Playground (https://vulert.com/scanner) to check if your Tor installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if any open-source vulnerabilities are detected.
There are no known exploits for this vulnerability at the moment. However, it is important to upgrade to the fixed versions of Tor to mitigate the risk.
You can find more information about this vulnerability in the Tor Security Advisory on the Tor Project's blog: https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack
Related vulnerabilities
Recent vulnerabilities recorded for tor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
