CVE catalog
CVE-2023-36325
UBUNTU-CVE-2023-36325
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.50% · Oct 25, 2026
i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy (it may be dropped, or may result in a Wrong Destination response). An attack would take days to complete.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | i2p | 18.04 | 0.9.30-4 | vulnerable |
| Ubuntu | i2p | 18.04 | 0.9.32-2 | vulnerable |
| Ubuntu | i2p | 18.04 | 0.9.34-1ubuntu1 | vulnerable |
| Ubuntu | i2p | 18.04 | 0.9.34-1ubuntu3 | vulnerable |
| Ubuntu | i2p | 20.04 | 0.9.41-2 | vulnerable |
| Ubuntu | i2p | 20.04 | 0.9.42-1 | vulnerable |
| Ubuntu | i2p | 20.04 | 0.9.44-1 | vulnerable |
| Ubuntu | i2p | 20.04 | 0.9.44-2 | vulnerable |
| Ubuntu | i2p | 20.04 | 0.9.44-3 | vulnerable |
| Ubuntu | i2p | 22.04 | 0.9.48-1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: