CVE-2020-8516 Information disclosure in n/a
Tor daemon fails to verify rendezvous nodes, potentially allowing remote attackers to discover circuit information, though vendors claim this is intended behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8516?
CVE-2020-8516 is a medium-severity vulnerability in n/a, published on 2 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
Which versions are affected by CVE-2020-8516?
It affects 1 product.
Products include Torproject Tor.
How do I fix CVE-2020-8516?
No fix has been published for CVE-2020-8516 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8516 being exploited?
There is no known exploitation of CVE-2020-8516 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2020-8516, GHSA-gvvc-pv9r-rg5q.