1. Home
  2. CVE Database
  3. CVE-2013-7295
MEDIUM · 4.0

CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) rela...

Vulnerability Description

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.

CVSS Score

4.0

MEDIUM

AV:N/AC:H/Au:N/C:P/I:P/A:N
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
NONE

Affected Products

VendorProductVersions
TorprojectTor<= 0.2.4.19

Related Weaknesses (CWE)

CWE-310

References

FAQ

What is CVE-2013-7295?

CVE-2013-7295 is a vulnerability with a CVSS score of 4.0 (MEDIUM). Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) rela...

How severe is CVE-2013-7295?

CVE-2013-7295 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-7295?

Check the references section above for vendor advisories and patch information. Affected products include: Torproject Tor.