CVE catalog

CVE-2023-23589

tor: CVE-2023-23589

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.86% · Oct 25, 2026

The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantorsid0.4.9.14-1fixed
Debiantorforky0.4.9.14-1fixed
Debiantortrixie0.4.9.11-0+deb13u1fixed
Debiantortrixie-security0.4.9.14-0+deb13u1fixed
Debiantorbookworm0.4.9.11-0+deb12u1fixed
Debiantorbookworm-security0.4.9.11-0+deb12u1fixed
Ubuntutorpro0.4.1.5-1vulnerable
Ubuntutorpro0.4.1.5-1build1vulnerable
Ubuntutorpro0.4.1.6-1vulnerable
Ubuntutorpro0.4.2.5-1vulnerable
Ubuntutorpro0.4.2.6-1vulnerable
Ubuntutorpro0.4.2.7-1vulnerable
Ubuntutorpro0.4.2.7-1ubuntu0.1~esm1vulnerable
Ubuntutor22.040.4.5.9-1vulnerable
Ubuntutor22.040.4.6.8-1vulnerable
Ubuntutor22.040.4.6.8-1build1vulnerable
Ubuntutor22.040.4.6.9-1vulnerable
Ubuntutor22.040.4.6.10-1vulnerable
Ubuntutor22.040.4.9.11-0ubuntu0.22.04.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantorsourcesid0.4.7.13-1not yet assignedNot reportedNot reported
Debiantorsourceforky0.4.7.13-1not yet assignedNot reportedNot reported
Debiantorsourcetrixie0.4.7.13-1not yet assignedNot reportedNot reported
Debiantorsourcebookworm0.4.7.13-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]