CVE-2013-7295: Torproject Tor

Medium severity, CVSS 4.0. EPSS: 1.8% chance of exploitation in the next 30 days.

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.

Affected products

• Torproject Tor: up to and including 0.2.4.19; version 0.2.4.1 only; version 0.2.4.2 only; version 0.2.4.3 only; version 0.2.4.4 only; version 0.2.4.5 only; …

Published 2014-01-17. Last modified 2026-06-17.