Vulnerability Details CVE-2021-39246
Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 30.0%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 3.6
References
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md
- https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9
- https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434
- https://sick.codes/sick-2021-111
- https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md
- https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9
- https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434
- https://sick.codes/sick-2021-111
- https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability
Products affected by CVE-2021-39246
-
cpe:2.3:a:torproject:tor_browser:-
-
cpe:2.3:a:torproject:tor_browser:11.0
-
cpe:2.3:a:torproject:tor_browser:5.5.2
-
cpe:2.3:a:torproject:tor_browser:5.5.3
-
cpe:2.3:a:torproject:tor_browser:5.5.4
-
cpe:2.3:a:torproject:tor_browser:5.5.5
-
cpe:2.3:a:torproject:tor_browser:6.0
-
cpe:2.3:a:torproject:tor_browser:6.0.1
-
cpe:2.3:a:torproject:tor_browser:6.0.2
-
cpe:2.3:a:torproject:tor_browser:6.0.3
-
cpe:2.3:a:torproject:tor_browser:6.0.4
-
cpe:2.3:a:torproject:tor_browser:6.0.5
-
cpe:2.3:a:torproject:tor_browser:6.0.6
-
cpe:2.3:a:torproject:tor_browser:6.0.7
-
cpe:2.3:a:torproject:tor_browser:6.0.8
-
cpe:2.3:a:torproject:tor_browser:6.5
-
cpe:2.3:a:torproject:tor_browser:6.5.1
-
cpe:2.3:a:torproject:tor_browser:6.5.2
-
cpe:2.3:a:torproject:tor_browser:7.0
-
cpe:2.3:a:torproject:tor_browser:7.0.1
-
cpe:2.3:a:torproject:tor_browser:7.0.10
-
cpe:2.3:a:torproject:tor_browser:7.0.11
-
cpe:2.3:a:torproject:tor_browser:7.0.2
-
cpe:2.3:a:torproject:tor_browser:7.0.3
-
cpe:2.3:a:torproject:tor_browser:7.0.4
-
cpe:2.3:a:torproject:tor_browser:7.0.5
-
cpe:2.3:a:torproject:tor_browser:7.0.6
-
cpe:2.3:a:torproject:tor_browser:7.0.7
-
cpe:2.3:a:torproject:tor_browser:7.0.9
-
cpe:2.3:a:torproject:tor_browser:7.5
-
cpe:2.3:a:torproject:tor_browser:7.5.3
-
cpe:2.3:a:torproject:tor_browser:7.5.6
-
cpe:2.3:a:torproject:tor_browser:8.0
-
cpe:2.3:a:torproject:tor_browser:8.0.1
-
cpe:2.3:a:torproject:tor_browser:8.0.2
-
cpe:2.3:a:torproject:tor_browser:8.0.3
-
cpe:2.3:a:torproject:tor_browser:8.0.4
-
cpe:2.3:a:torproject:tor_browser:8.0.5
-
cpe:2.3:a:torproject:tor_browser:8.0.6
-
cpe:2.3:a:torproject:tor_browser:8.0.7
-
cpe:2.3:a:torproject:tor_browser:8.0.8
-
cpe:2.3:a:torproject:tor_browser:8.0.9
-
cpe:2.3:a:torproject:tor_browser:8.5
-
cpe:2.3:a:torproject:tor_browser:8.5.1
-
cpe:2.3:a:torproject:tor_browser:8.5.2
-
cpe:2.3:a:torproject:tor_browser:8.5.3
-
cpe:2.3:a:torproject:tor_browser:8.5.4
-
cpe:2.3:a:torproject:tor_browser:9.0
-
cpe:2.3:o:apple:macos:-
-
cpe:2.3:o:linux:linux_kernel:-
-
cpe:2.3:o:microsoft:windows:-