CVEvulnerability
CVE-2017-0377
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-07-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
Affected configurations
• torproject tor 0.3.0.1
• torproject tor 0.3.0.2
• torproject tor 0.3.0.3
• torproject tor 0.3.0.4
• torproject tor 0.3.0.5
• torproject tor 0.3.0.6
• torproject tor 0.3.0.7
• torproject tor 0.3.0.8
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://blog.torproject.org/blog/tor-0309-released-security-update-clients Release Notes, Vendor Advisory
- https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients Release Notes, Vendor Advisory
- https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350 Patch, Third Party Advisory
- https://security-tracker.debian.org/CVE-2017-0377 Third Party Advisory
- https://trac.torproject.org/projects/tor/ticket/22753 Issue Tracking, Vendor Advisory
- https://blog.torproject.org/blog/tor-0309-released-security-update-clients Release Notes, Vendor Advisory
- https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients Release Notes, Vendor Advisory
- https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350 Patch, Third Party Advisory
- https://security-tracker.debian.org/CVE-2017-0377 Third Party Advisory
- https://trac.torproject.org/projects/tor/ticket/22753 Issue Tracking, Vendor Advisory