CVE-2023-23589
Fixed in a distro release EPSS <1%CVSS 6.5
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
Products: torproject tor, debian_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | tor | 0.3.5.16-1+deb10u1 |
| Debian 11 | tor | 0.4.5.16-1 |
| Debian 12 | tor | 0.4.7.13-1 |
| Debian 13 | tor | 0.4.7.13-1 |
| Debian 14 | tor | 0.4.7.13-1 |
| Ubuntu 22.04 LTS | tor | no fix |
| Ubuntu Pro 14.04 LTS | tor | no fix |
| Ubuntu Pro 16.04 LTS | tor | no fix |
| Ubuntu Pro 18.04 LTS | tor | no fix |
| Ubuntu Pro 20.04 LTS | tor | no fix |