CVE-2020-8516

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.htmlMailing List, Vendor Advisory
https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.htmlMailing List, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2020-8516Third Party Advisory
https://trac.torproject.org/projects/tor/ticket/33129Issue Tracking, Vendor Advisory
https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.htmlExploit, Mitigation, Technical Description, Third Party Advisory
https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.htmlMailing List, Vendor Advisory
https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.htmlMailing List, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2020-8516Third Party Advisory
https://trac.torproject.org/projects/tor/ticket/33129Issue Tracking, Vendor Advisory
https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.htmlExploit, Mitigation, Technical Description, Third Party Advisory

Timeline

Published: Feb 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-85177.5An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_CVE-2020-85189.8Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.CVE-2020-85199.8SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql CVE-2020-85209.8SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql CVE-2020-85219.8SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql CVE-2020-85397.8Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unaut CVE-2020-85409.8An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated CVE-2020-85416.5OX App Suite through 7.10.3 allows XXE attacks.CVE-2020-85425.4OX App Suite through 7.10.3 allows XSS.CVE-2020-85437.5OX App Suite through 7.10.3 has Improper Input Validation.CVE-2020-85446.5OX App Suite through 7.10.3 allows SSRF.CVE-2020-85457.5Global.py in AIL framework 2.8 allows path traversal.