The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password, which triggers an attempt by the OpenSSL library to ask the user for the password, aka TROVE-2017-011.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tor | Dec 8, 2017 | Dec 3, 2017 |
| Debian | — | Upgrade tor | Dec 4, 2017 | Dec 2, 2017 |
| Suse | — | Upgrade tor | Dec 2, 2017 | Dec 2, 2017 |
| Ubuntu | — | Upgrade tor | Nov 19, 2024 | Dec 3, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub