CVE-2020-15572: 
NixOS vulnerability analysis and mitigation

Tor before version 0.4.3.6 contained a vulnerability identified as CVE-2020-15572 (also known as TROVE-2020-001), which was discovered and disclosed in July 2020. The vulnerability specifically affected Tor instances that were built using Mozilla Network Security Services (NSS) encryption library, which was not the default configuration (Tor Blog).

The vulnerability was caused by an out-of-bounds memory access due to an API mismatch where NSS was providing a number of bits, but the system was expecting a number of bytes. This issue would manifest during certificate comparison operations during connection handshakes (GitLab Issue).

The vulnerability allowed remote attackers to perform a denial-of-service attack that could crash affected Tor instances. For relay nodes, any party performing a handshake could trigger the crash remotely, while affected clients could be crashed by their guards (Tor Blog).

The vulnerability was remotely exploitable through normal Tor protocol interactions. Any party who could perform a handshake with a Tor instance could trigger this bug, making it particularly concerning for public relay operators (GitLab Issue).

The vulnerability was fixed in Tor versions 0.3.5.11, 0.4.2.8, and 0.4.3.6. Users running Tor instances built with NSS were advised to upgrade to these versions or later. It's worth noting that installations built with OpenSSL (the default configuration) were not affected by this vulnerability (Tor Blog).