CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2024-35313
In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-130
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9328-gcfq-p269 | crates.io | arti | >=1.2.2 <1.2.3 | 1.2.3 |
| GHSA-9328-gcfq-p269 | crates.io | tor-circmgr | >=0.18.0 <0.18.1 | 0.18.1 |
| GHSA-c96h-cxx6-rmg9 | crates.io | tor-circmgr | >=0.18.0 <0.18.1 | 0.18.1 |
| GHSA-c96h-cxx6-rmg9 | crates.io | arti | >=1.2.2 <1.2.3 | 1.2.3 |
| RUSTSEC-2024-0339 | crates.io | tor-circmgr | >=0.18.0 <0.18.1 | 0.18.1 |
| RUSTSEC-2024-0340 | crates.io | tor-circmgr | >=0.18.0 <0.18.1 | 0.18.1 |