CVE-2023-23589

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffcPatch, Vendor Advisory
https://gitlab.torproject.org/tpo/core/tor/-/issues/40730Exploit, Issue Tracking, Patch, Vendor Advisory
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotesRelease Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00026.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/
https://security.gentoo.org/glsa/202305-11
https://www.debian.org/security/2023/dsa-5320Third Party Advisory
https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffcPatch, Vendor Advisory
https://gitlab.torproject.org/tpo/core/tor/-/issues/40730Exploit, Issue Tracking, Patch, Vendor Advisory
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotesRelease Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00026.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/
https://security.gentoo.org/glsa/202305-11
https://www.debian.org/security/2023/dsa-5320Third Party Advisory

Timeline

Published: Jan 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-23598.8The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload CVE-2023-235907.5Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated CVE-2023-235914.9The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs CVE-2023-235927.5WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information.CVE-2023-235949.8An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides rem CVE-2023-235957.5BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, s CVE-2023-235968.8jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with CVE-2023-235976.5A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `fi CVE-2023-235986.5Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dr CVE-2023-235996.5When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow CVE-2023-23607.5Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) befor CVE-2023-236006.5Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was grante