What is GHSA-9328-gcfq-p269?

GHSA-9328-gcfq-p269 is a security advisory published by GitHub Security Advisories with High severity. Tor Arti's STUB circuits incorrectly have a length of 2

Which CVE IDs does GHSA-9328-gcfq-p269 cover?

GHSA-9328-gcfq-p269 covers the following CVE IDs: CVE-2024-35312. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9328-gcfq-p269?

GHSA-9328-gcfq-p269 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-9328-gcfq-p269?

GHSA-9328-gcfq-p269 affects 2 products, including: rust/arti:= 1.2.2; rust/tor-circmgr:= 0.18.0.

GHSA-9328-gcfq-p269HighCVSS 7.5

Tor Arti's STUB circuits incorrectly have a length of 2

Vendor

GitHub Security Advisories

Published

May 18, 2024

Last Modified

November 4, 2024

🔗 CVE IDs covered (1)

CVE-2024-35312 →

📋 Description

In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.

🎯 Affected products2

rust/arti:= 1.2.2
rust/tor-circmgr:= 0.18.0

🔗 References (10)

https://nvd.nist.gov/vuln/detail/CVE-2024-35312
https://gitlab.torproject.org/tpo/core/arti/-/issues/1409
https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CHANGELOG.md#arti-123-15-may-2024
https://gitlab.torproject.org/tpo/core/arti/-/commit/da95138c14f762c706e46e89c6adfa46fcd5252c
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2145
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2154
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2156
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE
https://rustsec.org/advisories/RUSTSEC-2024-0339.html
https://github.com/advisories/GHSA-9328-gcfq-p269