CVE-2013-7295 | BDVDB-2026-59467 Detail

Description#

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html
https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html

Exploit#

No public exploit known

History#

Version 12014-01-17Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.