VULNERABILITY INTELLIGENCE
CVE-2017-0377
CVSS score7.5 HIGH
EPSS probability2.45%
CISA KEVNot currently listed
Published2017-07-02
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Primary references
- security@debian.org — Release Notes, Vendor Advisory
- security@debian.org — Release Notes, Vendor Advisory
- security@debian.org — Patch, Third Party Advisory
- security@debian.org — Third Party Advisory
- security@debian.org — Issue Tracking, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory