Detections
Analytics
Alpine: multiple tor packages: security update to 0.3.2.10-r0
high Tenable Cloud Security Plugin ID 407397
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The
directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of
service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that
is mishandled during voting. (CVE-2018-0490)
- A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause
a denial of service (relay crash) because the KIST implementation allows a channel to be added more than
once in the pending list. (CVE-2018-0491)
See Also
Plugin Details
Severity: High
ID: 407397
Version: Revision 1.29
Type: Local
Published: 10/31/2023
Updated: 12/4/2025
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 97
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2018-0491
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 3/3/2018
Reference Information
CVE: CVE-2018-0490, CVE-2018-0491