Your submission was sent successfully! Close

CVE-2017-8822

Published: 03 December 2017

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.

From the Ubuntu security team

It was discovered that Tor could make itself part of a circuit path resulting in degraded anonymity.

Priority

Low

CVSS 3 base score: 3.7

Status

Package Release Status
tor
Launchpad, Ubuntu, Debian
Upstream
Released (0.2.9.14-1, 0.3.1.9-1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(0.3.1.9-1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (0.2.9.14-1ubuntu1~16.04.2)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (0.2.4.27-1ubuntu0.1)