6.5 CVE-2023-23589
Exploit Patch
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
https://nvd.nist.gov/vuln/detail/CVE-2023-23589
Categories
CWE-NVD-noinfo
References
DEBIAN
| DSA-5320 Third Party Advisory |
FEDORA
| FEDORA-2023-c290171664 Mailing List Third Party Advisory |
| FEDORA-2023-1254a1fc28 Mailing List Third Party Advisory |
MISC Patch Exploit
| https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc Patch Vendor Advisory |
| https://gitlab.torproject.org/tpo/core/tor/-/issues/40730 Exploit Issue Tracking Patch Vendor Advisory |
| https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes Release Notes Vendor Advisory |
_MLIST
| [debian-lts-announce] 20230128 [SECURITY] [DLA 3286-1] tor security update Mailing List Third Party Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* | < 0.4.7.13 | |
| Configuration 2 | ||
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | ||
| Configuration 3 | ||
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | ||
Patch
| Url |
|---|
| https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc |
| https://gitlab.torproject.org/tpo/core/tor/-/issues/40730 |
Exploits
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
Other (github, ...)
| Url |
|---|
| https://gitlab.torproject.org/tpo/core/tor/-/issues/40730 |
CAPEC
| id | description | severity |
|---|---|---|
| No entry | ||
Sherlock® flash
Take a picture of your computer network in a few clicks !
The Sherlock® flash audit solution allows you to perform an audit to strengthen the security of your IT assets. Vulnerability analysis of your physical and virtual equipment. Patch planning by priority level and time available. Detailed and intuitive reporting.
