Find real vulnerabilities before they ship
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.
Base Score
3.7
| Base Score | 3.7 |
|---|---|
| Vector String | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Base Severity | Low |
| Version | 3.0 |
| Attack Vector (AV) | NETWORK |
