« Volver al listado

CVE-2025-4444

Estado: AplazadaMedia (6.3)—

A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Torproject — TORAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-4444",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-4444",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-18T20:41:11.076671Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "modules": [
            "Onion Service Descriptor Handler"
          ],
          "product": "Tor",
          "versions": [
            {
              "status": "affected",
              "version": "0.4.7.0"
            },
            {
              "status": "affected",
              "version": "0.4.7.1"
            },
            {
              "status": "affected",
              "version": "0.4.7.2"
            },
            {
              "status": "affected",
              "version": "0.4.7.3"
            },
            {
              "status": "affected",
              "version": "0.4.7.4"
            },
            {
              "status": "affected",
              "version": "0.4.7.5"
            },
            {
              "status": "affected",
              "version": "0.4.7.6"
            },
            {
              "status": "affected",
              "version": "0.4.7.7"
            },
            {
              "status": "affected",
              "version": "0.4.7.8"
            },
            {
              "status": "affected",
              "version": "0.4.7.9"
            },
            {
              "status": "affected",
              "version": "0.4.7.10"
            },
            {
              "status": "affected",
              "version": "0.4.7.11"
            },
            {
              "status": "affected",
              "version": "0.4.7.12"
            },
            {
              "status": "affected",
              "version": "0.4.7.13"
            },
            {
              "status": "affected",
              "version": "0.4.7.14"
            },
            {
              "status": "affected",
              "version": "0.4.7.15"
            },
            {
              "status": "affected",
              "version": "0.4.7.16"
            },
            {
              "status": "affected",
              "version": "0.4.8.0"
            },
            {
              "status": "affected",
              "version": "0.4.8.1"
            },
            {
              "status": "affected",
              "version": "0.4.8.2"
            },
            {
              "status": "affected",
              "version": "0.4.8.3"
            },
            {
              "status": "affected",
              "version": "0.4.8.4"
            },
            {
              "status": "affected",
              "version": "0.4.8.5"
            },
            {
              "status": "affected",
              "version": "0.4.8.6"
            },
            {
              "status": "affected",
              "version": "0.4.8.7"
            },
            {
              "status": "affected",
              "version": "0.4.8.8"
            },
            {
              "status": "affected",
              "version": "0.4.8.9"
            },
            {
              "status": "affected",
              "version": "0.4.8.10"
            },
            {
              "status": "affected",
              "version": "0.4.8.11"
            },
            {
              "status": "affected",
              "version": "0.4.8.12"
            },
            {
              "status": "affected",
              "version": "0.4.8.13"
            },
            {
              "status": "affected",
              "version": "0.4.8.14"
            },
            {
              "status": "affected",
              "version": "0.4.8.15"
            },
            {
              "status": "affected",
              "version": "0.4.8.16"
            },
            {
              "status": "affected",
              "version": "0.4.8.17"
            },
            {
              "status": "unaffected",
              "version": "0.4.8.18"
            },
            {
              "status": "unaffected",
              "version": "0.4.9.3-alpha"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-18T14:15:49.887",
  "references": [
    {
      "url": "https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/chunmianwang/Tordos",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?ctiid.324814",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.324814",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?submit.640605",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-404"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component."
    }
  ],
  "lastModified": "2026-06-17T09:33:15.893",
  "sourceIdentifier": "cna@vuldb.com"
}