CVE-2013-7295

Published: Jan 17, 2014Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Exploitability: 4.9 / Impact: 4.9

Source: NVD

Description

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.

Affected (19)

Products: Torproject: Tor

Torproject

1 product

Tor

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Torproject Tor	Up to 0.2.4.19
Torproject Tor	Version 0.2.4.10 alpha
Torproject Tor	Version 0.2.4.11 alpha
Torproject Tor	Version 0.2.4.12 alpha
Torproject Tor	Version 0.2.4.13 alpha
Torproject Tor	Version 0.2.4.14 alpha
Torproject Tor	Version 0.2.4.15 rc
Torproject Tor	Version 0.2.4.16 rc
Torproject Tor	Version 0.2.4.17 rc
Torproject Tor	Version 0.2.4.18 rc
Torproject Tor	Version 0.2.4.1 alpha
Torproject Tor	Version 0.2.4.2 alpha
Torproject Tor	Version 0.2.4.3 alpha
Torproject Tor	Version 0.2.4.4 alpha
Torproject Tor	Version 0.2.4.5 alpha
Torproject Tor	Version 0.2.4.6 alpha
Torproject Tor	Version 0.2.4.7 alpha
Torproject Tor	Version 0.2.4.8 alpha
Torproject Tor	Version 0.2.4.9 alpha

Related CWEs

CWE-310

References (4)

http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html

Source: cve@mitre.org

https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html

Source: cve@mitre.org

Vendor Advisory

http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.