What’s Vulnerable › Vulnerabilities
CVE-2017-0377
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-07-02 · updated 2026-06-17
- Weakness: CWE-200
Description
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
Affected products
- torproject Tor: 0.3.0.1-alpha, 0.3.0.2-alpha, 0.3.0.3-alpha, 0.3.0.4, 0.3.0.5, 0.3.0.6 (+2)
References
- https://blog.torproject.org/blog/tor-0309-released-security-update-clients
- https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients
- https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350
- https://security-tracker.debian.org/CVE-2017-0377
- https://trac.torproject.org/projects/tor/ticket/22753
- https://blog.torproject.org/blog/tor-0309-released-security-update-clients
- https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients
- https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350
- https://security-tracker.debian.org/CVE-2017-0377
- https://trac.torproject.org/projects/tor/ticket/22753
Get alerted when CVE-2017-0377 or the next vulnerability affects your stack