Описание
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
A flaw was found in Tor. A remote attacker could exploit a race condition within the rendezvous point mechanism to impersonate an onion service. This man-in-the-middle attack allows the attacker to intercept and potentially alter communications between a client and the intended onion service, leading to information disclosure or data manipulation.
Отчет
This vulnerability is rated as Important severity because an untrusted relay functioning as a rendezvous point can subvert cryptographic session binding and fully intercept client communication, although exploitation requires winning a specific timing race. The Tor package is not included with Red Hat Enterprise Linux by default and is only provided through extra community repositories such as EPEL. Systems that do not run Tor or establish circuits to onion services are unaffected by this flaw.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
EPSS
8.9 High
CVSS3
Связанные уязвимости
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
Tor before 0.4.9.11 is prone to a race condition where in just the rig ...
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
EPSS
8.9 High
CVSS3