CVE-2020-10593
Gentoo Linux Security Advisory 202003-50
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.
Tor versiones anteriores a 0.3.5.10, versiones 0.4.x anteriores a 0.4.1.9 y versiones 0.4.2.x anteriores a 0.4.2.7, permite a atacantes remotos causar una Denegación de servicio (pérdida de memoria), también se conoce como TROVE-2020-004. Esto ocurre en la función circpad_setup_machine_on_circ porque una máquina de circuit-padding se puede negociar dos veces en el mismo circuito.
An update that fixes two vulnerabilities is now available. This update for tor to version 0.3.5.10 fixes the following issues. Fixed a CPU consumption denial of service and timing patterns. Fixed a circuit padding memory leak.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-03-15 CVE Reserved
- 2020-03-19 CVE Published
- 2024-08-04 CVE Updated
- 2025-06-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://trac.torproject.org/projects/tor/ticket/33619 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html | 2023-02-03 | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html | 2023-02-03 | |
| https://security.gentoo.org/glsa/202003-50 | 2023-02-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Torproject Search vendor "Torproject" | Tor Search vendor "Torproject" for product "Tor" | >= 0.3.5 < 0.3.5.10 Search vendor "Torproject" for product "Tor" and version " >= 0.3.5 < 0.3.5.10" | - |
Affected
| ||||||
| Torproject Search vendor "Torproject" | Tor Search vendor "Torproject" for product "Tor" | > 0.4.1.0 < 0.4.1.9 Search vendor "Torproject" for product "Tor" and version " > 0.4.1.0 < 0.4.1.9" | - |
Affected
| ||||||
| Torproject Search vendor "Torproject" | Tor Search vendor "Torproject" for product "Tor" | > 0.4.2.0 <= 0.4.2.7 Search vendor "Torproject" for product "Tor" and version " > 0.4.2.0 <= 0.4.2.7" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Backports Sle Search vendor "Opensuse" for product "Backports Sle" | 15.0 Search vendor "Opensuse" for product "Backports Sle" and version "15.0" | sp1 |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||