CVE Details for CVE: CVE-2018-0491
Summary
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
| Timestamps | |
|---|---|
| Last major update | 26-03-2019 - 18:52 |
| Published | 05-03-2018 - 15:29 |
| Last modified | 26-03-2019 - 18:52 |
Vulnerable Configurations
-
cpe:2.3:a:torproject:tor:0.3.2.1:alpha:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.1:alpha:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.2:alpha:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.2:alpha:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.3:alpha:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.3:alpha:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.4:alpha:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.4:alpha:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.5:alpha:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.5:alpha:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.6:alpha:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.6:alpha:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.7:rc:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.7:rc:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.8:rc:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.8:rc:*:*:*:*:*:*
-
cpe:2.3:a:torproject:tor:0.3.2.9:*:*:*:*:*:*:*
cpe:2.3:a:torproject:tor:0.3.2.9:*:*:*:*:*:*:*
CWE
CVSS
Base
5.0
Impact
2.9
Exploitability
10.0
Access
| Vector | Complexity | Authentication |
|---|---|---|
| NETWORK | LOW | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| NONE | NONE | PARTIAL |
CVSS3
Base
7.5
Impact
3.6
Exploitability
3.9
Access
| Attack Complexity | Attack vector | Privileges Required | Scope | User Interaction |
|---|---|---|---|---|
| LOW | NETWORK | NONE | UNCHANGED | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| NONE | NONE | HIGH |