7.5

CVE-2019-8955: torproject tor

CVSS: 7.5v3.0HighModified
AliasesopenSUSE-SU-2019:1107-1UBUNTU-CVE-2019-8955DEBIAN-CVE-2019-8955
Published 21-02-2019Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2019-8955 is a high (CVSS 7.5) vulnerability in torproject tor. EPSS estimates a 4.57% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
4.57%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2024:11469-1USN-5036-1

Timeline

  1. 21-02-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

4.57%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.57% on 19-09-2026

19-09-202619-10-2026
EPSS score
4.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse2 products
  • tor&distro=SUSE Package Hub 12< 0.3.4.11-bp150.3.6.1
  • tor&distro=SUSE Package Hub 15< 0.3.4.11-bp150.3.6.1
Debian1 product
  • tor< 0.3.5.8-1
Opensuse1 product
  • tor&distro=openSUSE Leap 15.0< 0.3.4.11-bp150.3.6.1
Torproject1 product
  • tor< 0.3.3.12 | ≥ 0.3.4.8, < 0.3.4.11 | 0.3.4.0:alpha-dev | 0.3.4.1:alpha | 0.3.4.2:alpha | 0.3.4.3:alpha | 0.3.4.4:rc | 0.3.4.5:rc | 0.3.4.6:rc | 0.3.4.7:rc | 0.3.5.0:alpha-dev | 0.3.5.1:alpha | 0.3.5.2:alpha | 0.3.5.3:alpha | 0.3.5.4:alpha | 0.3.5.5:alpha | 0.3.5.6:rc | 0.3.5.7 | 0.4.0.1:alpha
Ubuntu1 product
  • tor< 0.3.2.10-1ubuntu0.2~esm1

5 vendors · 6 products

References

11 links
Show all 11 references