CVE-2021-38385

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-30 · updated 2026-06-17
Weakness: CWE-617

Description

Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.

Affected products

torproject Tor: before 0.3.5.16; from 0.4.0.0 before 0.4.5.10; from 0.4.6.0 before 0.4.6.7 — fixed in 0.3.5.16, 0.4.5.10, 0.4.6.7

How to fix

Upgrade to a fixed version: torproject Tor 0.3.5.16, 0.4.5.10, 0.4.6.7. Check the vendor advisory for mitigations.

References

https://blog.torproject.org
https://blog.torproject.org/node/2062
https://bugs.torproject.org/tpo/core/tor/40078
https://security.gentoo.org/glsa/202305-11
https://blog.torproject.org
https://blog.torproject.org/node/2062
https://bugs.torproject.org/tpo/core/tor/40078
https://security.gentoo.org/glsa/202305-11

Get alerted when CVE-2021-38385 or the next vulnerability affects your stack