CVE-2017-0377

    Dashboard / Vulnerabilities / CVE-2017-0377

    CVE-2017-0377

    Published: 2 Jul 2017Last Modified: 8 Jul 2026

    Summary:

    Details: Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

    References: https://blog.torproject.org/blog/tor-0309-released-security-update-clients, https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients, https://security-tracker.debian.org/CVE-2017-0377, https://trac.torproject.org/projects/tor/ticket/22753, https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ac04fcd2e758c2258cbde8c8f31586695cb5d666
    Fixed -None

    Affected versions

    0.3.0.1-alpha
    0.3.0.2-alpha
    0.3.0.3-alpha
    0.3.0.6
    0.3.0.7
    0.3.0.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-0377 | CVE-DB