Vulnerability · Published Jan 18, 2022 · Assigned by GitHub_M

CVE-2022-21689Denial of Service in Onionshare

High 7.5

In plain English

A high-severity uncontrolled resource consumption in onionshare from onionshare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.3%top 28.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions the receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	onionshare	2.5-1	DEBIAN-CVE-2022-21689
Debian:13	onionshare	2.5-1	DEBIAN-CVE-2022-21689
Debian:14	onionshare	2.5-1	DEBIAN-CVE-2022-21689
PyPI	onionshare-cli	2.5	GHSA-jh82-c5jw-pxpc
PyPI	onionshare-cli	2.5	PYSEC-2022-40

Affected products (as reported)

Vendor	Product	Versions
onionshare	onionshare	< 2.5

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/onionshare/onionshare/releases/tag/v2.5 x_refsource_MISC
https://github.com/onionshare/onionshare/security/advisories/GHSA-jh82-c5jw-pxpc x_refsource_CONFIRM