CVE-2017-0377 Information disclosure in Tor
Attackers can defeat Tor's anonymity by exploiting a guard-selection flaw that ignores relay families, compromising user privacy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-0377?
CVE-2017-0377 is a high-severity vulnerability in Tor, published on 2 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
Weakness: CWE-200
Which versions are affected by CVE-2017-0377?
It affects 1 product.
Products include Torproject Tor.
How do I fix CVE-2017-0377?
Upgrade to a fixed version.
Is CVE-2017-0377 being exploited?
There is no known exploitation of CVE-2017-0377 in the wild and no public exploit code.
Other vulnerabilities in Tor
Sources
Also known as GHSA-vxgf-qp88-w686.